Fix CalDAV/CardDAV multiget loading entire collections into memory

A REPORT multiget for a handful of resources previously listed the
whole calendar/address book (every row incl. ical_data/vcard) and
filtered by href in Rust with an O(N×M) substring scan. Large
collections paid full-table latency, RAM and DB CPU on every sync.

- Add find_events_by_ical_uids / get_contacts_by_uids through every
  layer (domain repo trait → PG repo → storage port/adapter → use case
  → handler) using one indexed `= ANY($2)` query, mirroring the
  existing single-UID lookups.
- Extract UIDs from multiget hrefs with a shared, tested
  uid_from_multiget_href helper (percent-decoding, case-insensitive
  extension strip, collection hrefs rejected). Exact UID matching also
  removes the false positives the old substring filter allowed.
- CalDAV PROPFIND single-event path now uses the existing indexed
  get_event_by_ical_uid instead of listing all events.
- Honour the already-documented limit/offset query params on
  GET /api/address-books/{id}/contacts: optional ListQuery fields
  thread through ContactUseCase::list_contacts to a paginated repo
  query. Omitted params keep returning the full book (frontend and
  DAV listing/sync paths unchanged).

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

src/interfaces/api/handlers/caldav_handler.rs

@@ -27,6 +27,7 @@ use std::fmt::Write;
 use std::sync::Arc;
 
 use crate::application::adapters::caldav_adapter::{CalDavAdapter, CalDavReportType};
+use crate::application::adapters::uid_from_multiget_href;
 use crate::application::adapters::webdav_adapter::{PropFindRequest, PropFindType};
 use crate::application::dtos::calendar_dto::{
     CreateCalendarDto, CreateEventICalDto, UpdateCalendarDto,
@@ -422,17 +423,13 @@ async fn handle_propfind(
                 }
             };
 
-            // Individual event .ics
+            // Individual event .ics — indexed lookup by iCalendar UID.
             let ical_uid = event_path.trim_end_matches(".ics");
 
-            let events = calendar_service
-                .list_events(calendar_id, None, None, user.id)
+            let event = calendar_service
+                .get_event_by_ical_uid(calendar_id, ical_uid, user.id)
                 .await
-                .map_err(|e| AppError::internal_error(format!("Failed to list events: {}", e)))?;
-
-            let event = events
-                .iter()
-                .find(|e| e.ical_uid == ical_uid)
+                .map_err(|e| AppError::internal_error(format!("Failed to look up event: {}", e)))?
                 .ok_or_else(|| AppError::not_found(format!("Event not found: {}", ical_uid)))?;
 
             let base_href = &format!("/caldav/{}/", calendar_id);
@@ -444,7 +441,7 @@ async fn handle_propfind(
             let mut response_body = Vec::new();
             CalDavAdapter::generate_calendar_events_response(
                 &mut response_body,
-                std::slice::from_ref(event),
+                std::slice::from_ref(&event),
                 &report_type,
                 base_href,
             )
@@ -502,15 +499,18 @@ async fn handle_report(
             }
         }
         CalDavReportType::CalendarMultiget { hrefs, .. } => {
-            let all_events = calendar_service
-                .list_events(calendar_id, None, None, user.id)
-                .await
-                .map_err(|e| AppError::internal_error(format!("Failed to list events: {}", e)))?;
+            // Indexed batch lookup (`ical_uid = ANY(...)`) — a multiget for
+            // a handful of events must not pay for listing the whole
+            // calendar and filtering client-side.
+            let uids: Vec<String> = hrefs
+                .iter()
+                .filter_map(|href| uid_from_multiget_href(href, ".ics"))
+                .collect();
 
-            all_events
-                .into_iter()
-                .filter(|evt| hrefs.iter().any(|href| href.contains(&evt.ical_uid)))
-                .collect()
+            calendar_service
+                .get_events_by_ical_uids(calendar_id, &uids, user.id)
+                .await
+                .map_err(|e| AppError::internal_error(format!("Failed to fetch events: {}", e)))?
         }
         CalDavReportType::SyncCollection { .. } => calendar_service
             .list_events(calendar_id, None, None, user.id)

src/interfaces/api/handlers/carddav_handler.rs

@@ -28,6 +28,7 @@ use std::sync::Arc;
 use crate::application::adapters::carddav_adapter::{
     CardDavAdapter, CardDavReportType, contact_to_vcard,
 };
+use crate::application::adapters::uid_from_multiget_href;
 use crate::application::adapters::webdav_adapter::{PropFindRequest, PropFindType};
 use crate::application::dtos::address_book_dto::{CreateAddressBookDto, UpdateAddressBookDto};
 use crate::application::dtos::contact_dto::CreateContactVCardDto;
@@ -269,7 +270,7 @@ async fn handle_propfind(
 
             let contacts = if depth != "0" {
                 contact_svc
-                    .list_contacts(address_book_id, user.id)
+                    .list_contacts(address_book_id, None, None, user.id)
                     .await
                     .unwrap_or_default()
             } else {
@@ -359,22 +360,25 @@ async fn handle_report(
 
     let contacts = match &report {
         CardDavReportType::AddressbookQuery { .. } => contact_svc
-            .list_contacts(address_book_id, user.id)
+            .list_contacts(address_book_id, None, None, user.id)
             .await
             .map_err(|e| AppError::internal_error(format!("Failed to list contacts: {}", e)))?,
         CardDavReportType::AddressbookMultiget { hrefs, .. } => {
-            let all_contacts = contact_svc
-                .list_contacts(address_book_id, user.id)
-                .await
-                .map_err(|e| AppError::internal_error(format!("Failed to list contacts: {}", e)))?;
+            // Indexed batch lookup (`uid = ANY(...)`) — a multiget for a
+            // handful of contacts must not pay for listing the whole
+            // address book and filtering client-side.
+            let uids: Vec<String> = hrefs
+                .iter()
+                .filter_map(|href| uid_from_multiget_href(href, ".vcf"))
+                .collect();
 
-            all_contacts
-                .into_iter()
-                .filter(|c| hrefs.iter().any(|href| href.contains(&c.uid)))
-                .collect()
+            contact_svc
+                .get_contacts_by_uids(address_book_id, &uids, user.id)
+                .await
+                .map_err(|e| AppError::internal_error(format!("Failed to fetch contacts: {}", e)))?
         }
         CardDavReportType::SyncCollection { .. } => contact_svc
-            .list_contacts(address_book_id, user.id)
+            .list_contacts(address_book_id, None, None, user.id)
             .await
             .map_err(|e| AppError::internal_error(format!("Failed to list contacts: {}", e)))?,
     };
@@ -559,7 +563,7 @@ async fn handle_get(
     if parts.len() < 2 {
         // GET on address book collection — return all contacts as vcf
         let contacts = contact_svc
-            .list_contacts(address_book_id, user.id)
+            .list_contacts(address_book_id, None, None, user.id)
             .await
             .map_err(|e| AppError::internal_error(format!("Failed to list contacts: {}", e)))?;
 

src/interfaces/api/handlers/contacts_handler.rs

@@ -119,16 +119,14 @@ pub struct AddMemberRequest {
 }
 
 /// Query parameters for paginated listing.
+///
+/// Both fields are optional: when omitted, regular address books return
+/// the full contact list (the frontend relies on this), while the system
+/// book falls back to its own defaults (limit 100, offset 0).
 #[derive(Deserialize)]
 pub struct ListQuery {
-    #[serde(default = "default_limit")]
-    limit: i64,
-    #[serde(default)]
-    offset: i64,
-}
-
-fn default_limit() -> i64 {
-    100
+    limit: Option<i64>,
+    offset: Option<i64>,
 }
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -455,8 +453,8 @@ pub async fn delete_address_book(
     path = "/api/address-books/{book_id}/contacts",
     params(
         ("book_id" = String, Path, description = "Address book UUID or \"system\""),
-        ("limit"   = Option<i64>, Query, description = "Max results (default 100)"),
-        ("offset"  = Option<i64>, Query, description = "Pagination offset (default 0)"),
+        ("limit"   = Option<i64>, Query, description = "Max results (omit for the full book; system book defaults to 100)"),
+        ("offset"  = Option<i64>, Query, description = "Pagination offset (omit for none; system book defaults to 0)"),
     ),
     responses(
         (status = 200, description = "List of contacts"),
@@ -488,7 +486,10 @@ pub async fn list_contacts(
             return e.into_response();
         }
         let caller_id = auth_user.id.to_string();
-        match auth_service.list_users(params.limit, params.offset).await {
+        match auth_service
+            .list_users(params.limit.unwrap_or(100), params.offset.unwrap_or(0))
+            .await
+        {
             Ok(users) => {
                 let contacts: Vec<ContactDto> = users
                     .into_iter()
@@ -505,7 +506,7 @@ pub async fn list_contacts(
     } else {
         match state
             .contact_service
-            .list_contacts(&book_id, auth_user.id)
+            .list_contacts(&book_id, params.limit, params.offset, auth_user.id)
             .await
         {
             Ok(contacts) => (StatusCode::OK, Json(contacts)).into_response(),