cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

fix(dav): repair CalDAV/CardDAV client connectivity (#480)

Browse Source 
Standard CalDAV/CardDAV clients (Thunderbird, DAVx5, Apple
Calendar/Contacts) failed to connect, mounted collections read-only, or
could not discover address books, even though curl worked. Three
protocol-compliance gaps caused this:

1. Missing Basic-auth challenge on /caldav and /carddav.
   The 401 returned for these surfaces carried no `WWW-Authenticate`
   header (only /webdav did). Spec-compliant clients never send
   credentials preemptively the way `curl -u` does — they wait for the
   challenge — so Thunderbird never authenticated and failed with
   "discovery failed" / 401. Extend the challenge to all DAV surfaces via
   shared `is_dav_path` / `dav_basic_auth_challenge` helpers.

2. Calendars always advertised read-only.
   The `current-user-privilege-set` write gate compared `owner_id`
   against the literal string "current_user_id", which never matched a
   real UUID, so `<D:write/>` was never emitted and clients mounted every
   calendar read-only. Thread the caller's id through the CalDAV adapter
   and grant write when the caller owns the calendar.

3. CardDAV discovery was incomplete.
   There was no `/.well-known/carddav` route and the root PROPFIND
   exposed neither `current-user-principal` nor `addressbook-home-set`,
   so clients could not locate address books. Add the well-known redirect
   and root/principal discovery responses mirroring the CalDAV adapter.

Adds unit tests for the auth challenge predicate, the calendar
owner/non-owner privilege split, and the CardDAV root/principal discovery
responses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016cVV9nRQjP6G6a8zbNUWMw
This commit is contained in:
Claude
2026-06-19 08:38:27 +00:00
parent 8c325302b4
commit fe852d3b79
8 changed files with 605 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/interfaces/api/handlers/caldav_handler.rs
+7
View File
@@ -218,6 +218,9 @@ async fn handle_propfind(
.to_string();
let user = extract_user(&req)?;
// Caller UUID (string form) — gates the `<D:write/>` privilege on calendars
// the caller owns, so clients mount their own calendars read-write.
let caller_id = user.id.to_string();
let calendar_service = get_calendar_service(&state)?;
let body_bytes = body::to_bytes(req.into_body(), MAX_CALDAV_BODY)
@@ -256,6 +259,7 @@ async fn handle_propfind(
&propfind_request,
base_href,
&user.username,
&caller_id,
)
.map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
@@ -333,6 +337,7 @@ async fn handle_propfind(
&propfind_request,
base_href,
&depth,
&caller_id,
)
.map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
@@ -359,6 +364,7 @@ async fn handle_propfind(
&calendars,
&propfind_request,
base_href,
&caller_id,
)
.map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
@@ -407,6 +413,7 @@ async fn handle_propfind(
&propfind_request,
base_href,
&depth,
&caller_id,
)
.map_err(|e| {
AppError::internal_error(format!("Failed to generate XML: {}", e))
src/interfaces/api/handlers/carddav_handler.rs
+77 -7
View File
@@ -58,6 +58,24 @@ pub fn carddav_routes() -> Router<Arc<AppState>> {
.route("/carddav", axum::routing::any(handle_carddav_methods_root))
}
/// Creates the RFC 6764 well-known discovery route for CardDAV.
/// Public (no auth) — simply redirects to the CardDAV root so clients that
/// bootstrap from `/.well-known/carddav` can locate the service.
pub fn well_known_routes() -> Router<Arc<AppState>> {
Router::new().route(
"/.well-known/carddav",
axum::routing::any(handle_well_known_carddav),
)
}
async fn handle_well_known_carddav() -> Response<Body> {
Response::builder()
.status(StatusCode::MOVED_PERMANENTLY)
.header(header::LOCATION, "/carddav/")
.body(Body::empty())
.unwrap()
}
async fn handle_carddav_methods_root(
axum::extract::State(state): axum::extract::State<Arc<AppState>>,
req: Request<Body>,
@@ -226,10 +244,66 @@ async fn handle_propfind(
.map_err(|e| AppError::bad_request(format!("Failed to parse PROPFIND: {}", e)))?
};
// Discovery: the true root `/carddav/` advertises current-user-principal and
// addressbook-home-set so clients (DAVx5, Apple Contacts) can locate the
// address books. Depth 0 → only the root entry; Depth 1+ → also the books.
if path.is_empty() {
let address_books = if depth == "0" {
vec![]
} else {
addressbook_service
.list_user_address_books(user.id)
.await
.map_err(|e| {
AppError::internal_error(format!("Failed to list address books: {}", e))
})?
};
let mut response_body = Vec::new();
CardDavAdapter::generate_root_propfind_response(
&mut response_body,
&address_books,
&propfind_request,
"/carddav/",
&user.username,
)
.map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
return Ok(Response::builder()
.status(StatusCode::MULTI_STATUS)
.header(header::CONTENT_TYPE, "application/xml; charset=utf-8")
.body(Body::from(response_body))
.unwrap());
}
// Discovery: principal resource `/carddav/principals/{username}/` returns the
// addressbook-home-set the client should enumerate next.
if path == "principals" || path.starts_with("principals/") {
let username = path
.strip_prefix("principals/")
.map(|s| s.trim_end_matches('/'))
.filter(|s| !s.is_empty())
.unwrap_or(&user.username);
let mut response_body = Vec::new();
CardDavAdapter::generate_principal_propfind_response(
&mut response_body,
&propfind_request,
username,
)
.map_err(|e| AppError::internal_error(format!("Failed to generate XML: {}", e)))?;
return Ok(Response::builder()
.status(StatusCode::MULTI_STATUS)
.header(header::CONTENT_TYPE, "application/xml; charset=utf-8")
.body(Body::from(response_body))
.unwrap());
}
let effective_path = strip_username_prefix(path);
if effective_path.is_empty() {
// Root CardDAV path or user home — list user's address books
// User address-book home `/carddav/{username}/` — list the user's books.
let address_books = addressbook_service
.list_user_address_books(user.id)
.await
@@ -237,12 +311,8 @@ async fn handle_propfind(
AppError::internal_error(format!("Failed to list address books: {}", e))
})?;
let base_href = if path.is_empty() {
"/carddav/".to_string()
} else {
let user_part = path.split('/').next().unwrap_or(path);
format!("/carddav/{}/", user_part)
};
let user_part = path.split('/').next().unwrap_or(path);
let base_href = format!("/carddav/{}/", user_part);
let mut response_body = Vec::new();
CardDavAdapter::generate_addressbooks_propfind_response(
&mut response_body,
src/interfaces/middleware/auth.rs
+86 -23
View File
@@ -240,17 +240,12 @@ pub async fn auth_middleware(
}
Err(e) => {
tracing::warn!("App password verification failed: {}", e);
// For WebDAV: include WWW-Authenticate so the client
// knows to re-prompt rather than silently failing.
if request.uri().path().starts_with("/webdav") {
return Ok(Response::builder()
.status(StatusCode::UNAUTHORIZED)
.header(header::WWW_AUTHENTICATE, r#"Basic realm="OxiCloud""#)
.header(header::CONTENT_TYPE, "text/plain; charset=utf-8")
.body(axum::body::Body::from(
"Invalid username or app password",
))
.unwrap());
// For DAV clients: include WWW-Authenticate so the client
// re-prompts for credentials rather than failing silently.
if is_dav_path(request.uri().path()) {
return Ok(dav_basic_auth_challenge(
"Invalid username or app password",
));
}
return Err(AuthError::InvalidToken(
"Invalid username or app password".to_string(),
@@ -312,23 +307,41 @@ pub async fn auth_middleware(
return Err(AuthError::AuthServiceUnavailable);
}
// For WebDAV requests with no credentials at all: return 401 with
// WWW-Authenticate so that spec-compliant clients (Nautilus, Cyberduck,
// Windows Explorer, macOS Finder) know to prompt for a username/password.
// Non-WebDAV routes return the standard AuthError which renders without
// this header — keeping browser sessions redirecting to /login as before.
if request.uri().path().starts_with("/webdav") {
return Ok(Response::builder()
.status(StatusCode::UNAUTHORIZED)
.header(header::WWW_AUTHENTICATE, r#"Basic realm="OxiCloud""#)
.header(header::CONTENT_TYPE, "text/plain; charset=utf-8")
.body(axum::body::Body::from("Authentication required"))
.unwrap());
// For DAV requests with no credentials at all: return 401 with
// WWW-Authenticate so that spec-compliant clients (Thunderbird, DAVx5,
// Apple Calendar/Contacts, Nautilus, Cyberduck, Windows Explorer, macOS
// Finder) know to prompt for credentials and retry. Unlike `curl -u`, these
// clients do NOT send Basic credentials preemptively — without the
// challenge they never authenticate and fail with "discovery failed" / 401.
// Non-DAV routes return the standard AuthError which renders without this
// header — keeping browser sessions redirecting to /login as before.
if is_dav_path(request.uri().path()) {
return Ok(dav_basic_auth_challenge("Authentication required"));
}
Err(AuthError::TokenNotProvided)
}
/// DAV protocol surfaces (WebDAV, CalDAV, CardDAV) authenticate over HTTP Basic.
/// Spec-compliant clients (Thunderbird, DAVx5, Apple Calendar/Contacts, file
/// managers) only send credentials after receiving a `401` carrying a
/// `WWW-Authenticate: Basic` challenge, so these paths must emit it. Browser and
/// JSON-API routes deliberately do not, so they keep redirecting to `/login`.
fn is_dav_path(path: &str) -> bool {
path.starts_with("/webdav") || path.starts_with("/caldav") || path.starts_with("/carddav")
}
/// Build the `401 Unauthorized` Basic-auth challenge shared by every DAV
/// surface, so clients re-prompt for credentials instead of failing silently.
fn dav_basic_auth_challenge(message: &'static str) -> Response {
Response::builder()
.status(StatusCode::UNAUTHORIZED)
.header(header::WWW_AUTHENTICATE, r#"Basic realm="OxiCloud""#)
.header(header::CONTENT_TYPE, "text/plain; charset=utf-8")
.body(axum::body::Body::from(message))
.unwrap()
}
/// Middleware to verify that the authenticated user has an admin role.
///
/// Must be applied AFTER auth_middleware, as it depends on
@@ -353,3 +366,53 @@ pub async fn require_admin(request: Request, next: Next) -> Response {
let error = AuthError::AccessDenied("Admin role required".to_string());
error.into_response()
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn dav_paths_receive_basic_auth_challenge() {
// Regression for #480: CalDAV/CardDAV clients (Thunderbird, DAVx5) only
// send credentials after a 401 carrying WWW-Authenticate. All three DAV
// surfaces must qualify so the challenge is emitted.
for path in [
"/webdav/",
"/webdav/admin/file.txt",
"/caldav/",
"/caldav/admin/cal/",
"/carddav/",
"/carddav/principals/admin/",
] {
assert!(is_dav_path(path), "{path} should be treated as a DAV path");
}
}
#[test]
fn non_dav_paths_do_not_receive_basic_auth_challenge() {
for path in [
"/",
"/api/files",
"/login",
"/index.html",
"/.well-known/caldav",
] {
assert!(
!is_dav_path(path),
"{path} must not get a Basic-auth challenge (browser/API surface)"
);
}
}
#[test]
fn challenge_sets_www_authenticate_header() {
let resp = dav_basic_auth_challenge("Authentication required");
assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
assert_eq!(
resp.headers()
.get(header::WWW_AUTHENTICATE)
.and_then(|v| v.to_str().ok()),
Some(r#"Basic realm="OxiCloud""#),
);
}
}