Merge pull request #535 from swissiety/webdav-litmus-compliance

[QA] integrate litmus (WebDAV server protocol compliance test suite) into ci workflow and fix uncovered compliance issues

.github/workflows/ci.yml

@@ -369,6 +369,32 @@ jobs:
           path: tests/api/storage/
           retention-days: 7
 
+  litmus:
+    name: WebDAV RFC 4918 — litmus (59/59)
+    needs: build
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: oxicloud-release
+          path: target/release/
+
+      - name: Set execute bit on pre-built binary
+        run: chmod +x target/release/oxicloud
+
+      - name: Install litmus and jq
+        run: sudo apt-get update -q && sudo apt-get install -y litmus jq
+
+      - name: Run litmus WebDAV compliance tests
+        run: bash tests/webdav/run-litmus.sh
+        env:
+          BUILD_TARGET: release
+          LITMUS_TESTS: "basic copymove props locks"
+
   front-test:
     name: Frontend end-to-end tests (via Playwright)
     # ensure that api tests are ok before

migrations/20260825000000_webdav_dead_properties.sql

@@ -0,0 +1,20 @@
+-- WebDAV dead properties storage (RFC 4918 §9.2).
+-- Stores arbitrary user-defined XML properties set via PROPPATCH.
+-- Keyed by (resource_path, user_id, namespace, local_name) — the
+-- same property on different resources or for different users is
+-- a distinct row.
+
+CREATE TABLE IF NOT EXISTS storage.webdav_dead_properties (
+    id           UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+    resource_path TEXT       NOT NULL,
+    user_id      UUID        NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    namespace    TEXT        NOT NULL DEFAULT '',
+    local_name   TEXT        NOT NULL,
+    value        TEXT,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE (resource_path, user_id, namespace, local_name)
+);
+
+CREATE INDEX IF NOT EXISTS idx_webdav_dead_properties_path_user
+    ON storage.webdav_dead_properties (resource_path, user_id);

src/application/adapters/webdav_adapter.rs

@@ -96,6 +96,13 @@ pub struct PropValue {
     pub value: Option<String>,
 }
 
+/// A single PROPPATCH operation (preserves document order per RFC 4918 §9.2).
+#[derive(Debug, Clone)]
+pub enum PropPatchOp {
+    Set(PropValue),
+    Remove(QualifiedName),
+}
+
 /// WebDAV lock information
 #[derive(Debug, Clone)]
 pub struct LockInfo {
@@ -191,10 +198,31 @@ impl WebDavAdapter {
             if let Some(prefix) = key.strip_prefix("xmlns:") {
                 let uri = attr.unescape_value().unwrap_or_default().to_string();
                 ns_map.insert(prefix.to_string(), uri);
+            } else if key == "xmlns" {
+                // Default namespace declaration: xmlns="uri"
+                let uri = attr.unescape_value().unwrap_or_default().to_string();
+                ns_map.insert(String::new(), uri);
             }
         }
     }
 
+    /// Reject `xmlns:prefix=""` declarations — binding a prefix to an empty URI
+    /// is forbidden by the XML Namespaces 1.0 spec (RFC 4918 §8.1 requires 400).
+    fn check_ns_decls_valid(e: &BytesStart) -> Result<()> {
+        for attr in e.attributes().flatten() {
+            let key = std::str::from_utf8(attr.key.as_ref()).unwrap_or("");
+            if key.starts_with("xmlns:") {
+                let uri = attr.unescape_value().unwrap_or_default();
+                if uri.is_empty() {
+                    return Err(WebDavError::ParseError(
+                        "Invalid namespace declaration: prefix bound to empty URI".to_string(),
+                    ));
+                }
+            }
+        }
+        Ok(())
+    }
+
     /// Resolve a prefixed element name (e.g. `D:resourcetype`) to a
     /// `QualifiedName` using the accumulated namespace declarations.
     pub fn resolve_name(
@@ -208,6 +236,11 @@ impl WebDavAdapter {
                 return QualifiedName::new(uri.clone(), local.to_string());
             }
         }
+        // No prefix: check for a default namespace (xmlns="...").
+        // An empty string means xmlns="" — null namespace override, which is valid.
+        if let Some(default_ns) = ns_map.get("") {
+            return QualifiedName::new(default_ns.clone(), name_str.to_string());
+        }
         // Fallback: no prefix or unknown prefix → use legacy extraction
         QualifiedName::new(
             Self::extract_namespace(name_str),
@@ -222,6 +255,7 @@ impl WebDavAdapter {
 
         let mut buffer = Vec::new();
         let mut in_propfind = false;
+        let mut saw_propfind_close = false;
         let mut in_prop = false;
         let mut in_allprop = false;
         let mut in_propname = false;
@@ -232,6 +266,7 @@ impl WebDavAdapter {
             match xml_reader.read_event_into(&mut buffer) {
                 Ok(Event::Start(ref e)) => {
                     Self::collect_ns_decls(e, &mut ns_map);
+                    Self::check_ns_decls_valid(e)?;
                     let name = e.name();
                     let name_str = std::str::from_utf8(name.as_ref()).unwrap_or("");
 
@@ -258,6 +293,7 @@ impl WebDavAdapter {
 
                     if name_str == "propfind" || name_str.ends_with(":propfind") {
                         in_propfind = false;
+                        saw_propfind_close = true;
                     } else if name_str == "prop" || name_str.ends_with(":prop") {
                         in_prop = false;
                     } else if name_str == "allprop" || name_str.ends_with(":allprop") {
@@ -268,6 +304,7 @@ impl WebDavAdapter {
                 }
                 Ok(Event::Empty(ref e)) => {
                     Self::collect_ns_decls(e, &mut ns_map);
+                    Self::check_ns_decls_valid(e)?;
                     let name = e.name();
                     let name_str = std::str::from_utf8(name.as_ref()).unwrap_or("");
 
@@ -290,6 +327,16 @@ impl WebDavAdapter {
             buffer.clear();
         }
 
+        // RFC 4918 §8.1: non-well-formed XML MUST produce 400. quick-xml is
+        // lenient about EOF-inside-element (no XmlError on unclosed tags), so
+        // check explicitly: body must contain a complete <propfind>…</propfind>.
+        if !saw_propfind_close {
+            return Err(WebDavError::ParseError(
+                "PROPFIND body is not well-formed XML: missing or unclosed <propfind> element"
+                    .to_string(),
+            ));
+        }
+
         let prop_find_type = if in_allprop {
             PropFindType::AllProp
         } else if in_propname {
@@ -301,6 +348,115 @@ impl WebDavAdapter {
         Ok(PropFindRequest { prop_find_type })
     }
 
+    fn folder_prop_is_known(prop: &QualifiedName) -> bool {
+        prop.namespace == "DAV:"
+            && matches!(
+                prop.name.as_str(),
+                "resourcetype"
+                    | "displayname"
+                    | "creationdate"
+                    | "getlastmodified"
+                    | "getetag"
+                    | "getcontentlength"
+                    | "getcontenttype"
+            )
+    }
+
+    fn file_prop_is_known(prop: &QualifiedName) -> bool {
+        prop.namespace == "DAV:"
+            && matches!(
+                prop.name.as_str(),
+                "resourcetype"
+                    | "displayname"
+                    | "getcontenttype"
+                    | "getcontentlength"
+                    | "creationdate"
+                    | "getlastmodified"
+                    | "getetag"
+            )
+    }
+
+    /// Write a single qualified name as an empty XML element with proper namespace declaration.
+    ///
+    /// DAV: props use the `D:` prefix (already declared on the root element).
+    /// All other namespaces get a local `xmlns:X` declaration on the element itself.
+    fn write_qname_empty<W: Write>(xml_writer: &mut Writer<W>, prop: &QualifiedName) -> Result<()> {
+        if prop.namespace.is_empty() {
+            xml_writer.write_event(Event::Empty(BytesStart::new(prop.name.as_str())))?;
+        } else if prop.namespace == "DAV:" {
+            xml_writer.write_event(Event::Empty(BytesStart::new(format!("D:{}", prop.name))))?;
+        } else {
+            let tag = format!("X:{}", prop.name);
+            let mut start = BytesStart::new(tag.as_str());
+            start.push_attribute(("xmlns:X", prop.namespace.as_str()));
+            xml_writer.write_event(Event::Empty(start))?;
+        }
+        Ok(())
+    }
+
+    /// Write a 404 propstat block for unknown properties (RFC 4918 §9.2).
+    fn write_unknown_props_404<W: Write>(
+        xml_writer: &mut Writer<W>,
+        unknown: &[&QualifiedName],
+    ) -> Result<()> {
+        if unknown.is_empty() {
+            return Ok(());
+        }
+        xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+        xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+        for prop in unknown {
+            Self::write_qname_empty(xml_writer, prop)?;
+        }
+        xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+        xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+        xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 404 Not Found")))?;
+        xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+        xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+        Ok(())
+    }
+
+    /// Write a dead-property propstat block (RFC 4918 §4.2).
+    ///
+    /// Written AFTER the live-property propstats inside a `<D:response>`.
+    /// Only emitted when `dead_props` is non-empty.
+    fn write_dead_props_propstat<W: Write>(
+        xml_writer: &mut Writer<W>,
+        dead_props: &[(QualifiedName, Option<String>)],
+    ) -> Result<()> {
+        if dead_props.is_empty() {
+            return Ok(());
+        }
+        xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+        xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+        for (name, value) in dead_props {
+            let tag = if name.namespace.is_empty() {
+                name.name.clone()
+            } else {
+                format!("X:{}", name.name)
+            };
+            let mut start = BytesStart::new(tag.as_str());
+            if !name.namespace.is_empty() {
+                start.push_attribute(("xmlns:X", name.namespace.as_str()));
+            }
+            match value {
+                Some(v) if !v.is_empty() => {
+                    xml_writer.write_event(Event::Start(start))?;
+                    xml_writer.write_event(Event::Text(BytesText::new(v)))?;
+                    xml_writer.write_event(Event::End(BytesEnd::new(tag.as_str())))?;
+                }
+                _ => {
+                    xml_writer.write_event(Event::Empty(start))?;
+                }
+            }
+        }
+        xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+        xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+        xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+        xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+        xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+        Ok(())
+    }
+
     /// Write folder properties as a response
     fn write_folder_response<W: Write>(
         xml_writer: &mut Writer<W>,
@@ -308,50 +464,82 @@ impl WebDavAdapter {
         request: &PropFindRequest,
         href: &str,
     ) -> Result<()> {
-        // Start response element
+        Self::write_folder_response_with_dead_props(xml_writer, folder, request, href, &[])
+    }
+
+    fn write_folder_response_with_dead_props<W: Write>(
+        xml_writer: &mut Writer<W>,
+        folder: &FolderDto,
+        request: &PropFindRequest,
+        href: &str,
+        dead_props: &[(QualifiedName, Option<String>)],
+    ) -> Result<()> {
         xml_writer.write_event(Event::Start(BytesStart::new("D:response")))?;
 
-        // Write href
         xml_writer.write_event(Event::Start(BytesStart::new("D:href")))?;
         xml_writer.write_event(Event::Text(BytesText::new(href)))?;
         xml_writer.write_event(Event::End(BytesEnd::new("D:href")))?;
 
-        // Write propstat
+        // Compute dead props first so we can exclude them from the 404 propstat.
-        xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+        let relevant_dead: Vec<_> = match &request.prop_find_type {
+            PropFindType::Prop(requested) => dead_props
+                .iter()
+                .filter(|(name, _)| requested.iter().any(|r| r == name))
+                .cloned()
+                .collect(),
+            PropFindType::AllProp => dead_props.to_vec(),
+            PropFindType::PropName => vec![],
+        };
+        let dead_name_set: std::collections::HashSet<&QualifiedName> =
+            relevant_dead.iter().map(|(n, _)| n).collect();
 
-        // Start prop
-        xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
-
-        // Write properties based on request type
         match &request.prop_find_type {
-            PropFindType::AllProp => {
-                // Write all standard properties for a folder
-                Self::write_folder_standard_props(xml_writer, folder)?;
-            }
-            PropFindType::PropName => {
-                // Write only property names (empty elements)
-                Self::write_folder_prop_names(xml_writer)?;
-            }
             PropFindType::Prop(props) => {
-                // Write requested properties
+                // RFC 4918 §9.2: known props → 200 propstat; unknown → 404 propstat.
-                Self::write_folder_requested_props(xml_writer, folder, props)?;
+                // Props found in the dead store are returned in the dead 200 propstat,
+                // so exclude them from the 404 propstat to avoid duplicate reporting.
+                let (known, unknown): (Vec<_>, Vec<_>) =
+                    props.iter().partition(|p| Self::folder_prop_is_known(p));
+                let truly_unknown: Vec<_> = unknown
+                    .into_iter()
+                    .filter(|p| !dead_name_set.contains(*p))
+                    .collect();
+
+                xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+                Self::write_folder_requested_props(xml_writer, folder, &known)?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+                xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+
+                Self::write_unknown_props_404(xml_writer, &truly_unknown)?;
+            }
+            other => {
+                xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+                match other {
+                    PropFindType::AllProp => {
+                        Self::write_folder_standard_props(xml_writer, folder)?;
+                    }
+                    PropFindType::PropName => {
+                        Self::write_folder_prop_names(xml_writer)?;
+                    }
+                    PropFindType::Prop(_) => unreachable!(),
+                }
+                xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+                xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
             }
         }
 
-        // End prop
+        // Dead properties — written as a separate 200 propstat (RFC 4918 §4.2).
-        xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+        Self::write_dead_props_propstat(xml_writer, &relevant_dead)?;
 
-        // Write status
-        xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
-        xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
-        xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
-
-        // End propstat
-        xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
-
-        // End response
         xml_writer.write_event(Event::End(BytesEnd::new("D:response")))?;
-
         Ok(())
     }
 
@@ -362,50 +550,82 @@ impl WebDavAdapter {
         request: &PropFindRequest,
         href: &str,
     ) -> Result<()> {
-        // Start response element
+        Self::write_file_response_with_dead_props(xml_writer, file, request, href, &[])
+    }
+
+    fn write_file_response_with_dead_props<W: Write>(
+        xml_writer: &mut Writer<W>,
+        file: &FileDto,
+        request: &PropFindRequest,
+        href: &str,
+        dead_props: &[(QualifiedName, Option<String>)],
+    ) -> Result<()> {
         xml_writer.write_event(Event::Start(BytesStart::new("D:response")))?;
 
-        // Write href
         xml_writer.write_event(Event::Start(BytesStart::new("D:href")))?;
         xml_writer.write_event(Event::Text(BytesText::new(href)))?;
         xml_writer.write_event(Event::End(BytesEnd::new("D:href")))?;
 
-        // Write propstat
+        // Compute dead props first so we can exclude them from the 404 propstat.
-        xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+        let relevant_dead: Vec<_> = match &request.prop_find_type {
+            PropFindType::Prop(requested) => dead_props
+                .iter()
+                .filter(|(name, _)| requested.iter().any(|r| r == name))
+                .cloned()
+                .collect(),
+            PropFindType::AllProp => dead_props.to_vec(),
+            PropFindType::PropName => vec![],
+        };
+        let dead_name_set: std::collections::HashSet<&QualifiedName> =
+            relevant_dead.iter().map(|(n, _)| n).collect();
 
-        // Start prop
-        xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
-
-        // Write properties based on request type
         match &request.prop_find_type {
-            PropFindType::AllProp => {
-                // Write all standard properties for a file
-                Self::write_file_standard_props(xml_writer, file)?;
-            }
-            PropFindType::PropName => {
-                // Write only property names (empty elements)
-                Self::write_file_prop_names(xml_writer)?;
-            }
             PropFindType::Prop(props) => {
-                // Write requested properties
+                // RFC 4918 §9.2: known props → 200 propstat; unknown → 404 propstat.
-                Self::write_file_requested_props(xml_writer, file, props)?;
+                // Props found in the dead store are returned in the dead 200 propstat,
+                // so exclude them from the 404 propstat to avoid duplicate reporting.
+                let (known, unknown): (Vec<_>, Vec<_>) =
+                    props.iter().partition(|p| Self::file_prop_is_known(p));
+                let truly_unknown: Vec<_> = unknown
+                    .into_iter()
+                    .filter(|p| !dead_name_set.contains(*p))
+                    .collect();
+
+                xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+                Self::write_file_requested_props(xml_writer, file, &known)?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+                xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+
+                Self::write_unknown_props_404(xml_writer, &truly_unknown)?;
+            }
+            other => {
+                xml_writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+                match other {
+                    PropFindType::AllProp => {
+                        Self::write_file_standard_props(xml_writer, file)?;
+                    }
+                    PropFindType::PropName => {
+                        Self::write_file_prop_names(xml_writer)?;
+                    }
+                    PropFindType::Prop(_) => unreachable!(),
+                }
+                xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+                xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+                xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+                xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
             }
         }
 
-        // End prop
+        // Dead properties (RFC 4918 §4.2).
-        xml_writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+        Self::write_dead_props_propstat(xml_writer, &relevant_dead)?;
 
-        // Write status
-        xml_writer.write_event(Event::Start(BytesStart::new("D:status")))?;
-        xml_writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
-        xml_writer.write_event(Event::End(BytesEnd::new("D:status")))?;
-
-        // End propstat
-        xml_writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
-
-        // End response
         xml_writer.write_event(Event::End(BytesEnd::new("D:response")))?;
-
         Ok(())
     }
 
@@ -549,7 +769,7 @@ impl WebDavAdapter {
     fn write_folder_requested_props<W: Write>(
         xml_writer: &mut Writer<W>,
         folder: &FolderDto,
-        props: &[QualifiedName],
+        props: &[&QualifiedName],
     ) -> Result<()> {
         for prop in props {
             if prop.namespace == "DAV:" {
@@ -611,20 +831,11 @@ impl WebDavAdapter {
                         xml_writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
                     }
                     _ => {
-                        // Property not supported - write empty element
+                        // Unknown prop — skipped here; caller writes 404 propstat.
-                        xml_writer.write_event(Event::Empty(BytesStart::new(format!(
-                            "D:{}",
-                            prop.name
-                        ))))?;
                     }
                 }
-            } else {
-                // Non-DAV namespace, not supported
-                xml_writer.write_event(Event::Empty(BytesStart::new(format!(
-                    "{}:{}",
-                    prop.namespace, prop.name
-                ))))?;
             }
+            // Non-DAV namespace props are unknown — skipped; caller writes 404 propstat.
         }
 
         Ok(())
@@ -634,7 +845,7 @@ impl WebDavAdapter {
     fn write_file_requested_props<W: Write>(
         xml_writer: &mut Writer<W>,
         file: &FileDto,
-        props: &[QualifiedName],
+        props: &[&QualifiedName],
     ) -> Result<()> {
         for prop in props {
             if prop.namespace == "DAV:" {
@@ -694,27 +905,21 @@ impl WebDavAdapter {
                         xml_writer.write_event(Event::End(BytesEnd::new("D:getetag")))?;
                     }
                     _ => {
-                        // Property not supported - write empty element
+                        // Unknown prop — skipped here; caller writes 404 propstat.
-                        xml_writer.write_event(Event::Empty(BytesStart::new(format!(
-                            "D:{}",
-                            prop.name
-                        ))))?;
                     }
                 }
-            } else {
-                // Non-DAV namespace, not supported
-                xml_writer.write_event(Event::Empty(BytesStart::new(format!(
-                    "{}:{}",
-                    prop.namespace, prop.name
-                ))))?;
             }
+            // Non-DAV namespace props are unknown — skipped; caller writes 404 propstat.
         }
 
         Ok(())
     }
 
-    /// Parse a PROPPATCH XML request
+    /// Parse a PROPPATCH XML request.
-    pub fn parse_proppatch<R: Read>(reader: R) -> Result<(Vec<PropValue>, Vec<QualifiedName>)> {
+    ///
+    /// Returns operations in document order (RFC 4918 §9.2 requires document-order
+    /// processing so that remove-then-set and set-then-remove yield different results).
+    pub fn parse_proppatch<R: Read>(reader: R) -> Result<Vec<PropPatchOp>> {
         let mut xml_reader = Reader::from_reader(BufReader::new(reader));
         xml_reader.config_mut().trim_text(true);
 
@@ -724,8 +929,7 @@ impl WebDavAdapter {
         let mut in_remove = false;
         let mut in_prop = false;
         let mut current_prop: Option<QualifiedName> = None;
-        let mut props_to_set = Vec::new();
+        let mut ops: Vec<PropPatchOp> = Vec::new();
-        let mut props_to_remove = Vec::new();
         let mut current_text = String::new();
         let mut ns_map = std::collections::HashMap::<String, String>::new();
 
@@ -757,7 +961,30 @@ impl WebDavAdapter {
                     }
                 }
                 Ok(Event::Text(e)) if current_prop.is_some() => {
-                    current_text.push_str(&e.decode().unwrap_or_default());
+                    let raw = e.decode().unwrap_or_default();
+                    let unescaped =
+                        quick_xml::escape::unescape(&raw).unwrap_or_else(|_| raw.clone());
+                    current_text.push_str(&unescaped);
+                }
+                Ok(Event::GeneralRef(ref e)) if current_prop.is_some() => {
+                    // quick-xml 0.39 emits GeneralRef for character references like &#65536;
+                    // and named entity references like &amp;. Resolve them to actual chars.
+                    match e.resolve_char_ref() {
+                        Ok(Some(ch)) => current_text.push(ch),
+                        Ok(None) => {
+                            if let Ok(name) = e.decode() {
+                                match name.as_ref() {
+                                    "amp" => current_text.push('&'),
+                                    "lt" => current_text.push('<'),
+                                    "gt" => current_text.push('>'),
+                                    "apos" => current_text.push('\''),
+                                    "quot" => current_text.push('"'),
+                                    _ => {}
+                                }
+                            }
+                        }
+                        Err(_) => {}
+                    }
                 }
                 Ok(Event::End(ref e)) => {
                     let name = e.name();
@@ -771,19 +998,18 @@ impl WebDavAdapter {
                         s if s == "remove" || s.ends_with(":remove") => in_remove = false,
                         s if s == "prop" || s.ends_with(":prop") => in_prop = false,
                         _ if in_prop => {
-                            // End of property element
                             if let Some(prop_name) = current_prop.take() {
                                 if in_set {
-                                    props_to_set.push(PropValue {
+                                    ops.push(PropPatchOp::Set(PropValue {
                                         name: prop_name,
                                         value: if current_text.is_empty() {
                                             None
                                         } else {
                                             Some(current_text.clone())
                                         },
-                                    });
+                                    }));
                                 } else if in_remove {
-                                    props_to_remove.push(prop_name);
+                                    ops.push(PropPatchOp::Remove(prop_name));
                                 }
                             }
                             current_text.clear();
@@ -800,12 +1026,12 @@ impl WebDavAdapter {
                         let qname = Self::resolve_name(name_str, &ns_map);
 
                         if in_set {
-                            props_to_set.push(PropValue {
+                            ops.push(PropPatchOp::Set(PropValue {
                                 name: qname,
                                 value: None,
-                            });
+                            }));
                         } else if in_remove {
-                            props_to_remove.push(qname);
+                            ops.push(PropPatchOp::Remove(qname));
                         }
                     }
                 }
@@ -817,7 +1043,7 @@ impl WebDavAdapter {
             buffer.clear();
         }
 
-        Ok((props_to_set, props_to_remove))
+        Ok(ops)
     }
 
     /// Generate a PROPPATCH response
@@ -862,12 +1088,7 @@ impl WebDavAdapter {
 
             // Write property names
             for prop in success_props {
-                let prop_name = if prop.namespace == "DAV:" {
+                Self::write_qname_empty(&mut xml_writer, prop)?;
-                    format!("D:{}", prop.name)
-                } else {
-                    format!("{}:{}", prop.namespace, prop.name)
-                };
-                xml_writer.write_event(Event::Empty(BytesStart::new(&prop_name)))?;
             }
 
             // End prop
@@ -891,12 +1112,7 @@ impl WebDavAdapter {
 
             // Write property names
             for prop in failed_props {
-                let prop_name = if prop.namespace == "DAV:" {
+                Self::write_qname_empty(&mut xml_writer, prop)?;
-                    format!("D:{}", prop.name)
-                } else {
-                    format!("{}:{}", prop.namespace, prop.name)
-                };
-                xml_writer.write_event(Event::Empty(BytesStart::new(&prop_name)))?;
             }
 
             // End prop
@@ -1143,7 +1359,7 @@ impl WebDavAdapter {
         Self::write_folder_response(writer, folder, request, href)
     }
 
-    /// Writes a single `<D:response>` element for a file.
+    /// Writes a single `<D:response>` element for a file, including dead properties.
     pub fn write_file_entry<W: Write>(
         writer: &mut Writer<W>,
         file: &FileDto,
@@ -1152,4 +1368,26 @@ impl WebDavAdapter {
     ) -> Result<()> {
         Self::write_file_response(writer, file, request, href)
     }
+
+    /// Writes a folder entry including dead (custom) properties.
+    pub fn write_folder_entry_with_dead_props<W: Write>(
+        writer: &mut Writer<W>,
+        folder: &FolderDto,
+        request: &PropFindRequest,
+        href: &str,
+        dead_props: &[(QualifiedName, Option<String>)],
+    ) -> Result<()> {
+        Self::write_folder_response_with_dead_props(writer, folder, request, href, dead_props)
+    }
+
+    /// Writes a file entry including dead (custom) properties.
+    pub fn write_file_entry_with_dead_props<W: Write>(
+        writer: &mut Writer<W>,
+        file: &FileDto,
+        request: &PropFindRequest,
+        href: &str,
+        dead_props: &[(QualifiedName, Option<String>)],
+    ) -> Result<()> {
+        Self::write_file_response_with_dead_props(writer, file, request, href, dead_props)
+    }
 }

src/common/di.rs

@@ -1542,6 +1542,8 @@ impl AppServiceFactory {
             path_resolver: None,
             webdav_lock_store:
                 crate::infrastructure::services::webdav_lock_service::create_webdav_lock_store(),
+            webdav_dead_props:
+                crate::infrastructure::services::webdav_dead_property_store::create_dead_property_store(pool.clone()),
             authorization: authorization.clone(),
             drive_repo: drive_repo.clone(),
             drive_management_service: Arc::new(
@@ -2010,6 +2012,8 @@ pub struct AppState {
         Option<Arc<crate::infrastructure::services::path_resolver_service::PathResolverService>>,
     pub webdav_lock_store:
         Arc<crate::infrastructure::services::webdav_lock_service::WebDavLockStore>,
+    pub webdav_dead_props:
+        Arc<crate::infrastructure::services::webdav_dead_property_store::DeadPropertyStore>,
     /// ReBAC authorization engine — all service-layer permission checks go
     /// through this. Concrete type today is `PgAclEngine`; the
     /// `AuthorizationEngine` trait describes the contract. When alternate

src/infrastructure/services/mod.rs

@@ -42,6 +42,7 @@ pub mod thumbnail_service;
 mod thumbnail_service_test;
 pub mod trash_cleanup_service;
 pub mod tree_etag_flush_service;
+pub mod webdav_dead_property_store;
 pub mod webdav_lock_service;
 pub mod wopi_discovery_service;
 pub mod zip_service;

src/infrastructure/services/webdav_dead_property_store.rs

@@ -0,0 +1,184 @@
+//! PostgreSQL-backed dead property store for WebDAV PROPPATCH / PROPFIND compliance.
+//!
+//! RFC 4918 §4.2 defines "dead properties" as those stored verbatim by the
+//! server without interpreting their value. Properties are persisted to
+//! `storage.webdav_dead_properties` and survive server restarts.
+
+use std::sync::Arc;
+
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::application::adapters::webdav_adapter::QualifiedName;
+use crate::domain::errors::DomainError;
+
+pub struct DeadPropertyStore {
+    pool: Arc<PgPool>,
+}
+
+impl DeadPropertyStore {
+    pub fn new(pool: Arc<PgPool>) -> Self {
+        Self { pool }
+    }
+
+    /// Upsert a dead property. `value = None` means an empty XML element.
+    pub async fn set(
+        &self,
+        path: &str,
+        user_id: Uuid,
+        name: QualifiedName,
+        value: Option<String>,
+    ) -> Result<(), DomainError> {
+        sqlx::query!(
+            r#"
+            INSERT INTO storage.webdav_dead_properties
+                (resource_path, user_id, namespace, local_name, value)
+            VALUES ($1, $2, $3, $4, $5)
+            ON CONFLICT (resource_path, user_id, namespace, local_name)
+            DO UPDATE SET value = EXCLUDED.value, updated_at = CURRENT_TIMESTAMP
+            "#,
+            path,
+            user_id,
+            name.namespace,
+            name.name,
+            value,
+        )
+        .execute(&*self.pool)
+        .await
+        .map_err(|e| DomainError::internal_error("DeadPropertyStore", format!("set: {e}")))?;
+        Ok(())
+    }
+
+    /// Delete a specific dead property. No-op if not present.
+    pub async fn remove(
+        &self,
+        path: &str,
+        user_id: Uuid,
+        name: &QualifiedName,
+    ) -> Result<(), DomainError> {
+        sqlx::query!(
+            "DELETE FROM storage.webdav_dead_properties
+             WHERE resource_path = $1 AND user_id = $2
+               AND namespace = $3 AND local_name = $4",
+            path,
+            user_id,
+            name.namespace,
+            name.name,
+        )
+        .execute(&*self.pool)
+        .await
+        .map_err(|e| DomainError::internal_error("DeadPropertyStore", format!("remove: {e}")))?;
+        Ok(())
+    }
+
+    /// Return all dead properties for `path`.
+    pub async fn get_all(
+        &self,
+        path: &str,
+        user_id: Uuid,
+    ) -> Result<Vec<(QualifiedName, Option<String>)>, DomainError> {
+        let rows = sqlx::query!(
+            "SELECT namespace, local_name, value
+             FROM storage.webdav_dead_properties
+             WHERE resource_path = $1 AND user_id = $2",
+            path,
+            user_id,
+        )
+        .fetch_all(&*self.pool)
+        .await
+        .map_err(|e| DomainError::internal_error("DeadPropertyStore", format!("get_all: {e}")))?;
+
+        Ok(rows
+            .into_iter()
+            .map(|r| (QualifiedName::new(r.namespace, r.local_name), r.value))
+            .collect())
+    }
+
+    /// Return a specific dead property, or `None` if not stored.
+    /// Returns `Some(None)` when the property exists with an empty value.
+    pub async fn get(
+        &self,
+        path: &str,
+        user_id: Uuid,
+        name: &QualifiedName,
+    ) -> Result<Option<Option<String>>, DomainError> {
+        let row = sqlx::query!(
+            "SELECT value FROM storage.webdav_dead_properties
+             WHERE resource_path = $1 AND user_id = $2
+               AND namespace = $3 AND local_name = $4",
+            path,
+            user_id,
+            name.namespace,
+            name.name,
+        )
+        .fetch_optional(&*self.pool)
+        .await
+        .map_err(|e| DomainError::internal_error("DeadPropertyStore", format!("get: {e}")))?;
+
+        Ok(row.map(|r| r.value))
+    }
+
+    /// Delete all dead properties for `path` (called on DELETE).
+    pub async fn remove_resource(&self, path: &str, user_id: Uuid) -> Result<(), DomainError> {
+        sqlx::query!(
+            "DELETE FROM storage.webdav_dead_properties
+             WHERE resource_path = $1 AND user_id = $2",
+            path,
+            user_id,
+        )
+        .execute(&*self.pool)
+        .await
+        .map_err(|e| {
+            DomainError::internal_error("DeadPropertyStore", format!("remove_resource: {e}"))
+        })?;
+        Ok(())
+    }
+
+    /// Move dead properties from `old_path` to `new_path` (called on MOVE).
+    /// Clears any stale properties at `new_path` first.
+    pub async fn rename_resource(
+        &self,
+        old_path: &str,
+        user_id: Uuid,
+        new_path: &str,
+    ) -> Result<(), DomainError> {
+        let mut tx = self.pool.begin().await.map_err(|e| {
+            DomainError::internal_error("DeadPropertyStore", format!("rename_resource tx: {e}"))
+        })?;
+
+        sqlx::query!(
+            "DELETE FROM storage.webdav_dead_properties
+             WHERE resource_path = $1 AND user_id = $2",
+            new_path,
+            user_id,
+        )
+        .execute(&mut *tx)
+        .await
+        .map_err(|e| {
+            DomainError::internal_error("DeadPropertyStore", format!("rename_resource delete: {e}"))
+        })?;
+
+        sqlx::query!(
+            "UPDATE storage.webdav_dead_properties
+             SET resource_path = $2
+             WHERE resource_path = $1 AND user_id = $3",
+            old_path,
+            new_path,
+            user_id,
+        )
+        .execute(&mut *tx)
+        .await
+        .map_err(|e| {
+            DomainError::internal_error("DeadPropertyStore", format!("rename_resource update: {e}"))
+        })?;
+
+        tx.commit().await.map_err(|e| {
+            DomainError::internal_error("DeadPropertyStore", format!("rename_resource commit: {e}"))
+        })?;
+        Ok(())
+    }
+}
+
+pub fn create_dead_property_store(pool: Arc<PgPool>) -> Arc<DeadPropertyStore> {
+    Arc::new(DeadPropertyStore::new(pool))
+}

src/infrastructure/services/webdav_lock_service.rs

@@ -106,15 +106,27 @@ impl WebDavLockStore {
 
     /// Attempt to acquire a lock on `path`.
     ///
-    /// Returns `Ok(LockEntry)` on success, or `Err(existing)` if the resource
+    /// Returns `Ok(LockEntry)` on success, or `Err(existing)` when:
-    /// is already exclusively locked by a different token.
+    /// - The existing lock is exclusive (blocks any new lock), or
+    /// - The new lock is exclusive and any lock already exists (RFC 4918 §7.8).
     #[allow(clippy::result_large_err)]
     pub fn acquire(&self, path: &str, info: LockInfo) -> Result<LockEntry, LockEntry> {
-        // Check for existing conflicting lock
+        if let Some(existing) = self.by_path.get(path) {
-        if let Some(existing) = self.by_path.get(path)
+            // Exclusive existing lock → blocks everything.
-            && existing.info.scope == LockScope::Exclusive
+            // New exclusive lock → blocked by any existing lock (shared or exclusive).
-        {
+            if existing.info.scope == LockScope::Exclusive || info.scope == LockScope::Exclusive {
-            return Err(existing);
+                return Err(existing);
+            }
+            // Both shared: keep the first holder as the enforcement sentinel in
+            // `by_path` so releasing a secondary holder cannot clear the lock.
+            // Register the new token only in the reverse index so UNLOCK works.
+            let entry = LockEntry {
+                info,
+                path: path.to_owned(),
+            };
+            self.by_token
+                .insert(entry.info.token.clone(), path.to_owned());
+            return Ok(entry);
         }
 
         let entry = LockEntry {

src/interfaces/api/handlers/caldav_handler.rs

@@ -850,11 +850,10 @@ async fn handle_proppatch(
         .await
         .map_err(|e| AppError::bad_request(format!("Failed to read request body: {}", e)))?;
 
-    let (props_to_set, props_to_remove) =
+    let ops = crate::application::adapters::webdav_adapter::WebDavAdapter::parse_proppatch(
-        crate::application::adapters::webdav_adapter::WebDavAdapter::parse_proppatch(
+        body_bytes.reader(),
-            body_bytes.reader(),
+    )
-        )
+    .map_err(|e| AppError::bad_request(format!("Failed to parse PROPPATCH: {}", e)))?;
-        .map_err(|e| AppError::bad_request(format!("Failed to parse PROPPATCH: {}", e)))?;
 
     let effective_path = strip_username_prefix(path);
     let calendar_id = effective_path.split('/').next().unwrap_or(effective_path);
@@ -870,12 +869,14 @@ async fn handle_proppatch(
         is_public: None,
     };
 
-    for prop in &props_to_set {
+    for op in &ops {
-        match prop.name.name.as_str() {
+        if let crate::application::adapters::webdav_adapter::PropPatchOp::Set(prop) = op {
-            "displayname" => update.name = Some(prop.value.clone().unwrap_or_default()),
+            match prop.name.name.as_str() {
-            "calendar-description" => update.description = prop.value.clone(),
+                "displayname" => update.name = Some(prop.value.clone().unwrap_or_default()),
-            "calendar-color" => update.color = prop.value.clone(),
+                "calendar-description" => update.description = prop.value.clone(),
-            _ => {}
+                "calendar-color" => update.color = prop.value.clone(),
+                _ => {}
+            }
         }
     }
 
@@ -887,11 +888,15 @@ async fn handle_proppatch(
     }
 
     let mut results = Vec::new();
-    for prop in &props_to_set {
+    for op in &ops {
-        results.push((&prop.name, true));
+        match op {
-    }
+            crate::application::adapters::webdav_adapter::PropPatchOp::Set(prop) => {
-    for prop in &props_to_remove {
+                results.push((&prop.name, true));
-        results.push((prop, true));
+            }
+            crate::application::adapters::webdav_adapter::PropPatchOp::Remove(name) => {
+                results.push((name, true));
+            }
+        }
     }
 
     let href = format!("/caldav/{}", path);

src/interfaces/api/handlers/carddav_handler.rs

@@ -733,11 +733,10 @@ async fn handle_proppatch(
         .await
         .map_err(|e| AppError::bad_request(format!("Failed to read request body: {}", e)))?;
 
-    let (props_to_set, props_to_remove) =
+    let ops = crate::application::adapters::webdav_adapter::WebDavAdapter::parse_proppatch(
-        crate::application::adapters::webdav_adapter::WebDavAdapter::parse_proppatch(
+        body_bytes.reader(),
-            body_bytes.reader(),
+    )
-        )
+    .map_err(|e| AppError::bad_request(format!("Failed to parse PROPPATCH: {}", e)))?;
-        .map_err(|e| AppError::bad_request(format!("Failed to parse PROPPATCH: {}", e)))?;
 
     let effective_path = strip_username_prefix(path);
     let address_book_id = effective_path.split('/').next().unwrap_or(effective_path);
@@ -754,12 +753,14 @@ async fn handle_proppatch(
         user_id: user.id.to_string(),
     };
 
-    for prop in &props_to_set {
+    for op in &ops {
-        match prop.name.name.as_str() {
+        if let crate::application::adapters::webdav_adapter::PropPatchOp::Set(prop) = op {
-            "displayname" => update.name = Some(prop.value.clone().unwrap_or_default()),
+            match prop.name.name.as_str() {
-            "addressbook-description" => update.description = prop.value.clone(),
+                "displayname" => update.name = Some(prop.value.clone().unwrap_or_default()),
-            "calendar-color" | "addressbook-color" => update.color = prop.value.clone(),
+                "addressbook-description" => update.description = prop.value.clone(),
-            _ => {}
+                "calendar-color" | "addressbook-color" => update.color = prop.value.clone(),
+                _ => {}
+            }
         }
     }
 
@@ -773,11 +774,15 @@ async fn handle_proppatch(
     }
 
     let mut results = Vec::new();
-    for prop in &props_to_set {
+    for op in &ops {
-        results.push((&prop.name, true));
+        match op {
-    }
+            crate::application::adapters::webdav_adapter::PropPatchOp::Set(prop) => {
-    for prop in &props_to_remove {
+                results.push((&prop.name, true));
-        results.push((prop, true));
+            }
+            crate::application::adapters::webdav_adapter::PropPatchOp::Remove(name) => {
+                results.push((name, true));
+            }
+        }
     }
 
     let href = format!("/carddav/{}", path);

tests/dav_compliance/rfc4918_proppatch.rs

@@ -0,0 +1,343 @@
+//! RFC 4918 §9.2 PROPPATCH compliance — dead property storage and retrieval.
+
+use reqwest::Method;
+
+use super::harness::{get_server, unique_name};
+
+fn propfind() -> Method {
+    Method::from_bytes(b"PROPFIND").unwrap()
+}
+
+fn proppatch() -> Method {
+    Method::from_bytes(b"PROPPATCH").unwrap()
+}
+
+/// PROPPATCH set a custom property → 207 with 200 propstat.
+#[tokio::test]
+async fn proppatch_set_returns_207() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_set"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .put(srv.url(&path))
+        .header(k, v.clone())
+        .body("x")
+        .send()
+        .await
+        .unwrap();
+
+    let xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set>
+    <D:prop>
+      <Z:author>Alice</Z:author>
+    </D:prop>
+  </D:set>
+</D:propertyupdate>"#;
+
+    let res = srv
+        .client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v)
+        .header("Content-Type", "application/xml")
+        .body(xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), 207, "PROPPATCH must return 207");
+    let body = res.text().await.unwrap();
+    assert!(
+        body.contains("200") || body.contains("HTTP/1.1 200"),
+        "PROPPATCH 207 must contain 200 propstat; body: {body}"
+    );
+}
+
+/// PROPPATCH set → PROPFIND retrieves the stored value.
+#[tokio::test]
+async fn proppatch_set_property_visible_in_propfind() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_roundtrip"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .put(srv.url(&path))
+        .header(k, v.clone())
+        .body("data")
+        .send()
+        .await
+        .unwrap();
+
+    // Set dead property
+    let set_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set>
+    <D:prop>
+      <Z:color>blue</Z:color>
+    </D:prop>
+  </D:set>
+</D:propertyupdate>"#;
+
+    let pp_res = srv
+        .client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v.clone())
+        .header("Content-Type", "application/xml")
+        .body(set_xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(pp_res.status(), 207, "PROPPATCH set must return 207");
+
+    // Retrieve via PROPFIND allprop
+    let pf_res = srv
+        .client()
+        .request(propfind(), srv.url(&path))
+        .header(k, v)
+        .header("Depth", "0")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(pf_res.status(), 207);
+    let body = pf_res.text().await.unwrap();
+    assert!(
+        body.contains("color") || body.contains("blue"),
+        "PROPFIND allprop must include dead property set by PROPPATCH; body: {body}"
+    );
+}
+
+/// PROPPATCH remove → property absent from subsequent PROPFIND.
+#[tokio::test]
+async fn proppatch_remove_property_not_in_propfind() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_remove"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .put(srv.url(&path))
+        .header(k, v.clone())
+        .body("data")
+        .send()
+        .await
+        .unwrap();
+
+    // First set
+    let set_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:tag>removeme</Z:tag></D:prop></D:set>
+</D:propertyupdate>"#;
+    srv.client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v.clone())
+        .header("Content-Type", "application/xml")
+        .body(set_xml)
+        .send()
+        .await
+        .unwrap();
+
+    // Then remove
+    let remove_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:remove><D:prop><Z:tag/></D:prop></D:remove>
+</D:propertyupdate>"#;
+    let rem_res = srv
+        .client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v.clone())
+        .header("Content-Type", "application/xml")
+        .body(remove_xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(rem_res.status(), 207, "PROPPATCH remove must return 207");
+
+    // Verify gone — request the specific prop, expect 404 propstat
+    let pf_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propfind xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:prop><Z:tag/></D:prop>
+</D:propfind>"#;
+    let pf_res = srv
+        .client()
+        .request(propfind(), srv.url(&path))
+        .header(k, v)
+        .header("Depth", "0")
+        .header("Content-Type", "application/xml")
+        .body(pf_xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(pf_res.status(), 207);
+    let body = pf_res.text().await.unwrap();
+    assert!(
+        body.contains("404"),
+        "Removed dead property must appear in 404 propstat; body: {body}"
+    );
+}
+
+/// PROPPATCH set + remove in same request → both applied atomically.
+#[tokio::test]
+async fn proppatch_set_and_remove_in_same_request() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_setrem"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .put(srv.url(&path))
+        .header(k, v.clone())
+        .body("x")
+        .send()
+        .await
+        .unwrap();
+
+    // Pre-seed a property to remove
+    let seed_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:old>gone</Z:old></D:prop></D:set>
+</D:propertyupdate>"#;
+    srv.client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v.clone())
+        .header("Content-Type", "application/xml")
+        .body(seed_xml)
+        .send()
+        .await
+        .unwrap();
+
+    // Set new + remove old in one request
+    let xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:new>here</Z:new></D:prop></D:set>
+  <D:remove><D:prop><Z:old/></D:prop></D:remove>
+</D:propertyupdate>"#;
+    let res = srv
+        .client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v)
+        .header("Content-Type", "application/xml")
+        .body(xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), 207, "combined set+remove must return 207");
+    let body = res.text().await.unwrap();
+    // Both ops should succeed
+    assert!(
+        !body.contains("409") && !body.contains("403"),
+        "combined PROPPATCH must not fail; body: {body}"
+    );
+}
+
+/// PROPPATCH on non-existent resource → 404.
+#[tokio::test]
+async fn proppatch_nonexistent_resource_returns_404() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_ghost"));
+    let (k, v) = srv.auth();
+
+    let xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:x>y</Z:x></D:prop></D:set>
+</D:propertyupdate>"#;
+
+    let res = srv
+        .client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v)
+        .header("Content-Type", "application/xml")
+        .body(xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        res.status(),
+        404,
+        "PROPPATCH on non-existent resource must return 404"
+    );
+}
+
+/// PROPPATCH on collection (folder) → 207.
+#[tokio::test]
+async fn proppatch_on_collection_returns_207() {
+    let srv = get_server();
+    let col = format!("/webdav/{}", unique_name("pp_col"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .request(Method::from_bytes(b"MKCOL").unwrap(), srv.url(&col))
+        .header(k, v.clone())
+        .send()
+        .await
+        .unwrap();
+
+    let xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:desc>my folder</Z:desc></D:prop></D:set>
+</D:propertyupdate>"#;
+
+    let res = srv
+        .client()
+        .request(proppatch(), srv.url(&col))
+        .header(k, v)
+        .header("Content-Type", "application/xml")
+        .body(xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), 207, "PROPPATCH on collection must return 207");
+}
+
+/// PROPFIND specific dead property returns value in 200 propstat (not 404).
+#[tokio::test]
+async fn propfind_specific_dead_property_returns_200_propstat() {
+    let srv = get_server();
+    let path = format!("/webdav/{}", unique_name("pp_specific"));
+    let (k, v) = srv.auth();
+
+    srv.client()
+        .put(srv.url(&path))
+        .header(k, v.clone())
+        .body("x")
+        .send()
+        .await
+        .unwrap();
+
+    // Set
+    let set_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propertyupdate xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:set><D:prop><Z:rating>5</Z:rating></D:prop></D:set>
+</D:propertyupdate>"#;
+    srv.client()
+        .request(proppatch(), srv.url(&path))
+        .header(k, v.clone())
+        .header("Content-Type", "application/xml")
+        .body(set_xml)
+        .send()
+        .await
+        .unwrap();
+
+    // PROPFIND for that exact property
+    let pf_xml = r#"<?xml version="1.0" encoding="utf-8"?>
+<D:propfind xmlns:D="DAV:" xmlns:Z="http://example.com/ns/">
+  <D:prop><Z:rating/></D:prop>
+</D:propfind>"#;
+    let pf_res = srv
+        .client()
+        .request(propfind(), srv.url(&path))
+        .header(k, v)
+        .header("Depth", "0")
+        .header("Content-Type", "application/xml")
+        .body(pf_xml)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(pf_res.status(), 207);
+    let body = pf_res.text().await.unwrap();
+    assert!(
+        !body.contains("404"),
+        "Known dead property must not be in 404 propstat; body: {body}"
+    );
+    assert!(
+        body.contains("rating") || body.contains("5"),
+        "Response must include the dead property value; body: {body}"
+    );
+}

tests/webdav/run-litmus.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# WebDAV RFC 4918 compliance test using the litmus test suite.
+#
+# Usage (from repo root via justfile):
+#   just litmus-test
+#
+# Or directly (server + postgres must already be running):
+#   bash tests/webdav/run-litmus.sh
+#
+# Requires: litmus (apt install litmus), jq, curl
+# litmus tests: basic copymove props locks
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+COMMON="$REPO_ROOT/tests/common"
+WEBDAV_DIR="$REPO_ROOT/tests/webdav"
+
+source "$WEBDAV_DIR/test.env"
+
+SERVER_PORT="${base_url##*:}"
+
+log()  { echo "[litmus] $*"; }
+die()  { echo "[litmus] ERROR: $*" >&2; exit 1; }
+
+# ── Dependency checks ──────────────────────────────────────────────────────────
+
+if ! command -v litmus >/dev/null 2>&1; then
+    die "litmus not found. Install with: sudo apt install litmus"
+fi
+if ! command -v jq >/dev/null 2>&1; then
+    die "jq not found. Install with: sudo apt install jq"
+fi
+
+# ── Teardown ───────────────────────────────────────────────────────────────────
+
+SERVER_PID=""
+
+cleanup() {
+    if [[ -n "$SERVER_PID" ]]; then
+        log "Stopping OxiCloud (pid $SERVER_PID)..."
+        kill "$SERVER_PID" 2>/dev/null || true
+        wait "$SERVER_PID" 2>/dev/null || true
+    fi
+    bash "$COMMON/stop-db.sh"
+}
+
+trap cleanup EXIT
+
+# ── 1. Start postgres ──────────────────────────────────────────────────────────
+
+bash "$COMMON/spawn-db.sh"
+
+# ── 2. Start OxiCloud ─────────────────────────────────────────────────────────
+
+set -a
+source "$COMMON/server.env"
+OXICLOUD_SERVER_PORT=$SERVER_PORT
+OXICLOUD_STORAGE_PATH="$REPO_ROOT/tests/webdav/storage-litmus"
+set +a
+
+rm -rf "$OXICLOUD_STORAGE_PATH"
+mkdir -p "$OXICLOUD_STORAGE_PATH"
+
+BUILD_TARGET="${BUILD_TARGET:-debug}"
+OXICLOUD_BIN="$REPO_ROOT/target/$BUILD_TARGET/oxicloud"
+
+if [[ -x "$OXICLOUD_BIN" ]]; then
+    log "Starting pre-built OxiCloud ($BUILD_TARGET) on port $SERVER_PORT..."
+    "$OXICLOUD_BIN" --config "$COMMON/server.env" &
+else
+    log "Building and starting OxiCloud on port $SERVER_PORT..."
+    cd "$REPO_ROOT"
+    cargo build 2>&1
+    "$REPO_ROOT/target/debug/oxicloud" --config "$COMMON/server.env" &
+fi
+SERVER_PID=$!
+
+log "Waiting for server at $base_url..."
+deadline=$(( $(date +%s) + 60 ))
+until curl -sf "$base_url/ready" >/dev/null 2>&1; do
+    [[ $(date +%s) -ge $deadline ]] && die "Server did not become ready within 60s"
+    sleep 1
+done
+log "Server ready."
+
+# ── 3. Bootstrap admin + app password ────────────────────────────────────────
+
+SETUP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+    -X POST -H "Content-Type: application/json" \
+    -d "{\"username\":\"$username\",\"email\":\"$email\",\"password\":\"$password\"}" \
+    "$base_url/api/setup")
+case "$SETUP_STATUS" in
+    201) log "Admin account created." ;;
+    403) log "Admin account already exists." ;;
+    *)   die "Unexpected /api/setup status: $SETUP_STATUS" ;;
+esac
+
+LOGIN_RESP=$(curl -s -X POST -H "Content-Type: application/json" \
+    -d "{\"username\":\"$username\",\"password\":\"$password\"}" \
+    "$base_url/api/auth/login")
+JWT=$(jq -r '.access_token' <<<"$LOGIN_RESP")
+[[ -z "$JWT" || "$JWT" == "null" ]] && die "Login failed: $LOGIN_RESP"
+log "Logged in as $username."
+
+APP_PW_RESP=$(curl -s -X POST \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $JWT" \
+    -d '{"label":"litmus-test"}' \
+    "$base_url/api/auth/app-passwords")
+APP_PASSWORD=$(jq -r '.password' <<<"$APP_PW_RESP")
+[[ -z "$APP_PASSWORD" || "$APP_PASSWORD" == "null" ]] && die "App password creation failed: $APP_PW_RESP"
+log "App password created."
+
+# ── 4. Run litmus ─────────────────────────────────────────────────────────────
+
+LITMUS_TESTS="${LITMUS_TESTS:-basic copymove props locks}"
+WEBDAV_URL="$base_url/webdav/"
+
+log "Running litmus $LITMUS_TESTS against $WEBDAV_URL"
+TESTS="$LITMUS_TESTS" litmus "$WEBDAV_URL" "$username" "$APP_PASSWORD"
+
+log "litmus passed."