fix: URL-decode DAV paths with spaces + feat: app passwords for Basic Auth

Bug fix:
- URL-decode paths in extract_webdav_path(), extract_caldav_path(),
  extract_carddav_path() so folders with spaces (e.g. 'My Folder') no
  longer return 404 when accessed via encoded URIs (%20)
- Properly encode href values in PROPFIND/PROPPATCH/LOCK XML responses
- Decode Destination header in MOVE/COPY operations

New feature - App Passwords (API keys for DAV clients):
- POST /api/auth/app-passwords  → create (shows token once)
- GET  /api/auth/app-passwords  → list (prefix only)
- DELETE /api/auth/app-passwords/:id → revoke
- Auth middleware now accepts both Bearer JWT and Basic Auth
- Argon2 hashed, scoped (webdav/caldav/carddav), optional expiry
- Compatible with DAVx5, Thunderbird, rclone, curl

Tested: 12/12 E2E tests pass (create, list, WebDAV/CalDAV/CardDAV
Basic Auth, URL-decode with spaces, wrong password 401, revoke, post-
revoke 401).

This commit is contained in:

Dionisio

2026-03-01 20:34:12 +01:00

parent 48d853360e

commit 81987e9321

21 changed files with 963 additions and 68 deletions

									
										Cargo.toml
									
		+1
		
												View File
												
				@@ -44,6 +44,7 @@ md5 = "0.8.0"

				sha2 = "0.10.9"

				hex = "0.4.3"

				http-body-util = "0.1.3"

				percent-encoding = "2.3"

				reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots"] }

				base64 = "0.22.1"

				fs2 = "0.4"