dovenest

dovenest/server/tests/api_pim_schedule.rs
api_pim_schedule.rs
⎇
Raw
1//! Implicit scheduling (RFC 6638) between the accounts and rooms of one
2//! server.
3
4mod common;
5
6use axum::http::{Method, StatusCode};
7use common::*;
8use pimdav::xml::{self, CALDAV, DAV, Name};
9use serde_json::json;
10use xmltree::Element;
11
12const USERS: [&str; 3] = ["alice", "bob", "carol"];
13const PW: &str = "secret12345";
14
15struct Pim {
16 env: Env,
17 admin: Client,
18}
19
20impl Pim {
21 async fn new() -> Self {
22 let env = Env::new().await;
23 let admin = env.admin().await;
24 for u in USERS {
25 create_user(&admin, u, PW, &[]).await;
26 }
27 Pim { env, admin }
28 }
29
30 async fn req(
31 &self,
32 user: &str,
33 verb: &str,
34 path: &str,
35 extra: &[(&str, &str)],
36 body: &str,
37 ) -> Resp {
38 let auth = basic(user, PW);
39 let mut headers = vec![("authorization", auth.as_str())];
40 headers.extend_from_slice(extra);
41 Client::new(self.env.app.clone())
42 .raw(
43 Method::from_bytes(verb.as_bytes()).unwrap(),
44 path,
45 &headers,
46 body.as_bytes().to_vec(),
47 )
48 .await
49 }
50
51 /// The hrefs of the members of a collection.
52 async fn members(&self, user: &str, collection: &str) -> Vec<String> {
53 let r = self
54 .req(user, "PROPFIND", collection, &[("depth", "1")], "")
55 .await;
56 assert_eq!(r.status, StatusCode::MULTI_STATUS, "{}", r.text());
57 let root = Element::parse(r.body.as_slice()).unwrap();
58 xml::elements(&root)
59 .map(|resp| xml::text(xml::child(resp, DAV, "href").unwrap()))
60 .filter(|h| h != collection)
61 .collect()
62 }
63
64 /// The only object of a user's default calendar.
65 async fn copy(&self, user: &str) -> (String, Resp) {
66 let members = self.members(user, &cal(user)).await;
67 assert_eq!(members.len(), 1, "{members:?}");
68 let href = members[0].clone();
69 let r = self.req(user, "GET", &href, &[], "").await;
70 assert_eq!(r.status, StatusCode::OK);
71 (href, r)
72 }
73
74 async fn inbox(&self, user: &str) -> Vec<String> {
75 let mut out = Vec::new();
76 for href in self
77 .members(user, &format!("/pim/calendars/{user}/inbox/"))
78 .await
79 {
80 out.push(unfold(&self.req(user, "GET", &href, &[], "").await.text()));
81 }
82 out
83 }
84}
85
86fn cal(user: &str) -> String {
87 format!("/pim/calendars/{user}/default/")
88}
89
90fn addr(user: &str) -> String {
91 format!("mailto:{user}@filebrowser.invalid")
92}
93
94fn unfold(s: &str) -> String {
95 s.replace("\r\n ", "")
96}
97
98/// A parameter of the ATTENDEE property of `who`.
99fn attendee_param(ics: &str, who: &str, param: &str) -> Option<String> {
100 let suffix = format!(":{who}");
101 let unfolded = unfold(ics);
102 let line = unfolded
103 .lines()
104 .find(|l| l.starts_with("ATTENDEE") && l.ends_with(&suffix))?;
105 line.strip_suffix(&suffix)?
106 .split(';')
107 .find_map(|p| p.strip_prefix(&format!("{param}=")).map(str::to_string))
108}
109
110fn meeting(start: &str, attendees: &[&str]) -> String {
111 let attendees: String = attendees
112 .iter()
113 .map(|a| format!("ATTENDEE;RSVP=TRUE:{a}\r\n"))
114 .collect();
115 format!(
116 "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nBEGIN:VEVENT\r\nUID:meet-1\r\n\
117 DTSTAMP:20260101T000000Z\r\nDTSTART:{start}\r\nDURATION:PT1H\r\nSUMMARY:Planning\r\n\
118 ORGANIZER:{}\r\nATTENDEE;PARTSTAT=ACCEPTED:{}\r\n{attendees}END:VEVENT\r\nEND:VCALENDAR\r\n",
119 addr("alice"),
120 addr("alice")
121 )
122}
123
124const ALICE_EVENT: &str = "/pim/calendars/alice/default/meet.ics";
125
126async fn invite(pim: &Pim, attendees: &[&str]) -> Resp {
127 let r = pim
128 .req(
129 "alice",
130 "PUT",
131 ALICE_EVENT,
132 &[],
133 &meeting("20260301T100000Z", attendees),
134 )
135 .await;
136 assert_eq!(r.status, StatusCode::CREATED, "{}", r.text());
137 r
138}
139
140fn error_condition(r: &Resp) -> Name {
141 let root = Element::parse(r.body.as_slice()).unwrap_or_else(|_| panic!("{}", r.text()));
142 Name::of(xml::elements(&root).next().unwrap())
143}
144
145#[tokio::test]
146async fn discovery_names_inbox_and_outbox() {
147 let pim = Pim::new().await;
148 let r = pim.req("alice", "OPTIONS", "/pim/", &[], "").await;
149 assert!(r.header("dav").unwrap().contains("calendar-auto-schedule"));
150 let body = "<d:propfind xmlns:d=\"DAV:\" xmlns:c=\"urn:ietf:params:xml:ns:caldav\"><d:prop>\
151 <c:schedule-inbox-URL/><c:schedule-outbox-URL/></d:prop></d:propfind>";
152 let r = pim
153 .req("alice", "PROPFIND", "/pim/principals/alice/", &[], body)
154 .await;
155 let text = r.text();
156 assert!(text.contains("/pim/calendars/alice/inbox/"), "{text}");
157 assert!(text.contains("/pim/calendars/alice/outbox/"), "{text}");
158}
159
160#[tokio::test]
161async fn invite_and_answer() {
162 let pim = Pim::new().await;
163 let r = invite(
164 &pim,
165 &[
166 &addr("bob"),
167 &addr("carol"),
168 "mailto:dave@example.com",
169 &addr("nobody"),
170 ],
171 )
172 .await;
173 // The server added SCHEDULE-STATUS, so the stored bytes differ.
174 assert!(r.header("etag").is_none());
175 assert!(r.header("schedule-tag").is_some());
176
177 let org = unfold(&pim.req("alice", "GET", ALICE_EVENT, &[], "").await.text());
178 for (who, status) in [
179 (addr("bob"), "1.2"),
180 (addr("carol"), "1.2"),
181 ("mailto:dave@example.com".into(), "5.2"),
182 (addr("nobody"), "3.7"),
183 ] {
184 let got = attendee_param(&org, &who, "SCHEDULE-STATUS");
185 assert_eq!(got.as_deref(), Some(status), "{org}");
186 }
187
188 let (bob_href, got) = pim.copy("bob").await;
189 let bob_copy = unfold(&got.text());
190 let partstat = attendee_param(&bob_copy, &addr("bob"), "PARTSTAT");
191 assert_eq!(partstat.as_deref(), Some("NEEDS-ACTION"), "{bob_copy}");
192 assert!(
193 !bob_copy.contains("METHOD") && !bob_copy.contains("SCHEDULE-STATUS"),
194 "{bob_copy}"
195 );
196 let inbox = pim.inbox("bob").await;
197 assert_eq!(inbox.len(), 1);
198 assert!(inbox[0].contains("METHOD:REQUEST"));
199
200 // bob accepts, conditional on what he read.
201 let alice_tag = pim
202 .req("alice", "GET", ALICE_EVENT, &[], "")
203 .await
204 .header("schedule-tag");
205 let carol_tag = pim.copy("carol").await.1.header("schedule-tag");
206 let tag = got.header("schedule-tag").unwrap();
207 let accepted = bob_copy.replace("PARTSTAT=NEEDS-ACTION", "PARTSTAT=ACCEPTED");
208 let r = pim
209 .req(
210 "bob",
211 "PUT",
212 &bob_href,
213 &[("if-schedule-tag-match", &tag)],
214 &accepted,
215 )
216 .await;
217 assert_eq!(r.status, StatusCode::NO_CONTENT, "{}", r.text());
218 let bob_copy = unfold(&pim.req("bob", "GET", &bob_href, &[], "").await.text());
219 assert!(
220 bob_copy.contains("ORGANIZER;SCHEDULE-STATUS=1.2"),
221 "{bob_copy}"
222 );
223
224 // alice sees the answer; her Schedule-Tag stays, so her pending edit
225 // would still go through.
226 let r = pim.req("alice", "GET", ALICE_EVENT, &[], "").await;
227 assert_eq!(r.header("schedule-tag"), alice_tag);
228 let org = r.text();
229 assert_eq!(
230 attendee_param(&org, &addr("bob"), "SCHEDULE-STATUS").as_deref(),
231 Some("2.0")
232 );
233 assert_eq!(
234 attendee_param(&org, &addr("bob"), "PARTSTAT").as_deref(),
235 Some("ACCEPTED")
236 );
237 let replies = pim.inbox("alice").await;
238 assert_eq!(replies.len(), 1);
239 assert!(replies[0].contains("METHOD:REPLY"));
240
241 // carol's copy learns it quietly: same Schedule-Tag, no inbox entry.
242 let (_, carol) = pim.copy("carol").await;
243 assert_eq!(carol.header("schedule-tag"), carol_tag);
244 let seen = attendee_param(&carol.text(), &addr("bob"), "PARTSTAT");
245 assert_eq!(seen.as_deref(), Some("ACCEPTED"), "{}", carol.text());
246 assert_eq!(pim.inbox("carol").await.len(), 1);
247
248 // Deleting her copy declines for carol.
249 let (carol_href, _) = pim.copy("carol").await;
250 assert_eq!(
251 pim.req("carol", "DELETE", &carol_href, &[], "")
252 .await
253 .status,
254 StatusCode::NO_CONTENT
255 );
256 let org = pim.req("alice", "GET", ALICE_EVENT, &[], "").await.text();
257 assert_eq!(
258 attendee_param(&org, &addr("carol"), "PARTSTAT").as_deref(),
259 Some("DECLINED")
260 );
261}
262
263#[tokio::test]
264async fn organizer_changes_reach_attendees() {
265 let pim = Pim::new().await;
266 invite(&pim, &[&addr("bob"), &addr("carol")]).await;
267 let (bob_href, got) = pim.copy("bob").await;
268 let accepted = unfold(&got.text()).replace("PARTSTAT=NEEDS-ACTION", "PARTSTAT=ACCEPTED");
269 assert_eq!(
270 pim.req("bob", "PUT", &bob_href, &[], &accepted)
271 .await
272 .status,
273 StatusCode::NO_CONTENT
274 );
275 let org = pim.req("alice", "GET", ALICE_EVENT, &[], "").await.text();
276 assert_eq!(
277 attendee_param(&org, &addr("bob"), "PARTSTAT").as_deref(),
278 Some("ACCEPTED")
279 );
280 let bob_tag = pim.copy("bob").await.1.header("schedule-tag");
281
282 // Moving the meeting asks everyone again.
283 let moved = meeting("20260301T140000Z", &[&addr("bob"), &addr("carol")]);
284 assert_eq!(
285 pim.req("alice", "PUT", ALICE_EVENT, &[], &moved)
286 .await
287 .status,
288 StatusCode::NO_CONTENT
289 );
290 let (_, got) = pim.copy("bob").await;
291 let bob_copy = unfold(&got.text());
292 assert!(bob_copy.contains("DTSTART:20260301T140000Z"), "{bob_copy}");
293 let partstat = attendee_param(&bob_copy, &addr("bob"), "PARTSTAT");
294 assert_eq!(partstat.as_deref(), Some("NEEDS-ACTION"), "{bob_copy}");
295 assert_ne!(got.header("schedule-tag"), bob_tag);
296 assert_eq!(pim.inbox("bob").await.len(), 2);
297
298 // Dropping bob cancels his copy.
299 let without_bob = meeting("20260301T140000Z", &[&addr("carol")]);
300 pim.req("alice", "PUT", ALICE_EVENT, &[], &without_bob)
301 .await;
302 assert!(unfold(&pim.copy("bob").await.1.text()).contains("STATUS:CANCELLED"));
303 assert!(
304 pim.inbox("bob")
305 .await
306 .iter()
307 .any(|m| m.contains("METHOD:CANCEL"))
308 );
309
310 // Deleting the meeting cancels it for carol.
311 assert_eq!(
312 pim.req("alice", "DELETE", ALICE_EVENT, &[], "")
313 .await
314 .status,
315 StatusCode::NO_CONTENT
316 );
317 assert!(unfold(&pim.copy("carol").await.1.text()).contains("STATUS:CANCELLED"));
318}
319
320#[tokio::test]
321async fn attendees_have_limits() {
322 let pim = Pim::new().await;
323 invite(&pim, &[&addr("bob")]).await;
324 let (bob_href, got) = pim.copy("bob").await;
325 let bob_copy = unfold(&got.text());
326
327 let moved = bob_copy.replace("DTSTART:20260301T100000Z", "DTSTART:20260301T120000Z");
328 let r = pim.req("bob", "PUT", &bob_href, &[], &moved).await;
329 assert_eq!(r.status, StatusCode::FORBIDDEN);
330 assert!(error_condition(&r).is(CALDAV, "allowed-attendee-scheduling-object-change"));
331
332 let r = pim
333 .req(
334 "bob",
335 "PUT",
336 &bob_href,
337 &[("if-schedule-tag-match", "\"stale\"")],
338 &bob_copy,
339 )
340 .await;
341 assert_eq!(r.status, StatusCode::PRECONDITION_FAILED);
342 let into_inbox = pim
343 .req(
344 "bob",
345 "PUT",
346 "/pim/calendars/bob/inbox/x.ics",
347 &[],
348 &bob_copy,
349 )
350 .await;
351 assert_eq!(into_inbox.status, StatusCode::FORBIDDEN);
352
353 // A silent removal answers nothing.
354 let r = pim
355 .req("bob", "DELETE", &bob_href, &[("schedule-reply", "F")], "")
356 .await;
357 assert_eq!(r.status, StatusCode::NO_CONTENT);
358 let org = unfold(&pim.req("alice", "GET", ALICE_EVENT, &[], "").await.text());
359 assert!(!org.contains("DECLINED"), "{org}");
360 assert!(pim.inbox("alice").await.is_empty());
361}
362
363#[tokio::test]
364async fn rooms_receive_bookings() {
365 let pim = Pim::new().await;
366 let r = pim
367 .admin
368 .post_json(
369 "/api/admin/rooms",
370 &json!({"name": "board", "display_name": "Board", "kind": "room"}),
371 )
372 .await;
373 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
374 invite(&pim, &["mailto:board@rooms.filebrowser.invalid"]).await;
375 let org = pim.req("alice", "GET", ALICE_EVENT, &[], "").await.text();
376 let room = "mailto:board@rooms.filebrowser.invalid";
377 assert_eq!(
378 attendee_param(&org, room, "SCHEDULE-STATUS").as_deref(),
379 Some("1.2"),
380 "{org}"
381 );
382 // Everyone reads a room's bookings.
383 let members = pim.members("bob", "/pim/calendars/board/default/").await;
384 assert_eq!(members.len(), 1, "{members:?}");
385}
386
387const ROOM: &str = "mailto:board@rooms.filebrowser.invalid";
388
389/// `days` from now at `hour` UTC, as an iCalendar date-time. Rooms only
390/// check instances from now on.
391fn future(days: i64, hour: u32) -> String {
392 (chrono::Utc::now() + chrono::TimeDelta::days(days))
393 .date_naive()
394 .and_hms_opt(hour, 0, 0)
395 .unwrap()
396 .format("%Y%m%dT%H%M%SZ")
397 .to_string()
398}
399
400fn booking(uid: &str, organizer: &str, start: &str, extra: &str, attendees: &[&str]) -> String {
401 let attendees: String = attendees
402 .iter()
403 .map(|a| format!("ATTENDEE:{a}\r\n"))
404 .collect();
405 format!(
406 "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nBEGIN:VEVENT\r\nUID:{uid}\r\n\
407 DTSTAMP:20260101T000000Z\r\nDTSTART:{start}\r\nDURATION:PT1H\r\n{extra}\
408 ORGANIZER:{o}\r\nATTENDEE;PARTSTAT=ACCEPTED:{o}\r\n{attendees}END:VEVENT\r\nEND:VCALENDAR\r\n",
409 o = addr(organizer),
410 )
411}
412
413impl Pim {
414 async fn room(&self) {
415 let r = self
416 .admin
417 .post_json(
418 "/api/admin/rooms",
419 &json!({"name": "board", "display_name": "Board", "kind": "room"}),
420 )
421 .await;
422 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
423 }
424
425 async fn put_ok(&self, user: &str, path: &str, body: &str) {
426 let r = self.req(user, "PUT", path, &[], body).await;
427 assert!(r.status.is_success(), "{}: {}", r.status, r.text());
428 }
429
430 async fn get(&self, user: &str, path: &str) -> String {
431 unfold(&self.req(user, "GET", path, &[], "").await.text())
432 }
433}
434
435#[tokio::test]
436async fn outbox_answers_free_busy() {
437 let pim = Pim::new().await;
438 let event = |uid: &str, start: &str| {
439 format!(
440 "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nBEGIN:VEVENT\r\nUID:{uid}\r\n\
441 DTSTAMP:20260101T000000Z\r\nDTSTART:{start}\r\nDURATION:PT1H\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n"
442 )
443 };
444 pim.put_ok(
445 "bob",
446 &format!("{}busy.ics", cal("bob")),
447 &event("busy", "20260310T100000Z"),
448 )
449 .await;
450 // A calendar marked transparent adds no busy time.
451 let mk = "<c:mkcalendar xmlns:d=\"DAV:\" xmlns:c=\"urn:ietf:params:xml:ns:caldav\"><d:set><d:prop>\
452 <c:schedule-calendar-transp><c:transparent/></c:schedule-calendar-transp>\
453 </d:prop></d:set></c:mkcalendar>";
454 let r = pim
455 .req("bob", "MKCALENDAR", "/pim/calendars/bob/side/", &[], mk)
456 .await;
457 assert_eq!(r.status, StatusCode::CREATED, "{}", r.text());
458 pim.put_ok(
459 "bob",
460 "/pim/calendars/bob/side/x.ics",
461 &event("side", "20260310T120000Z"),
462 )
463 .await;
464 let body = "<d:propfind xmlns:d=\"DAV:\" xmlns:c=\"urn:ietf:params:xml:ns:caldav\"><d:prop>\
465 <c:schedule-calendar-transp/></d:prop></d:propfind>";
466 let r = pim
467 .req("bob", "PROPFIND", "/pim/calendars/bob/side/", &[], body)
468 .await;
469 assert!(r.text().contains("<c:transparent/>"), "{}", r.text());
470
471 let outbox = "/pim/calendars/alice/outbox/";
472 let r = pim.req("alice", "OPTIONS", outbox, &[], "").await;
473 assert!(r.header("allow").unwrap().contains("POST"));
474 let request = |organizer: &str| {
475 format!(
476 "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nMETHOD:REQUEST\r\n\
477 BEGIN:VFREEBUSY\r\nUID:fb\r\nDTSTAMP:20260101T000000Z\r\n\
478 DTSTART:20260310T000000Z\r\nDTEND:20260311T000000Z\r\nORGANIZER:{organizer}\r\n\
479 ATTENDEE:{}\r\nATTENDEE:{}\r\nATTENDEE:mailto:dave@example.com\r\n\
480 END:VFREEBUSY\r\nEND:VCALENDAR\r\n",
481 addr("bob"),
482 addr("nobody"),
483 )
484 };
485 let headers = [("content-type", "text/calendar")];
486 let r = pim
487 .req("alice", "POST", outbox, &headers, &request(&addr("alice")))
488 .await;
489 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
490 let root = Element::parse(r.body.as_slice()).unwrap();
491 let answers: Vec<(String, String, String)> = xml::elements(&root)
492 .map(|resp| {
493 let recipient = xml::child(resp, CALDAV, "recipient").unwrap();
494 let get = |local: &str| {
495 xml::child(resp, CALDAV, local)
496 .map(xml::text)
497 .unwrap_or_default()
498 };
499 (
500 xml::text(xml::child(recipient, DAV, "href").unwrap()),
501 get("request-status"),
502 unfold(&get("calendar-data")),
503 )
504 })
505 .collect();
506 assert_eq!(answers.len(), 3, "{answers:?}");
507 let (_, status, data) = &answers[0];
508 assert!(status.starts_with("2.0"), "{status}");
509 assert!(
510 data.contains("FREEBUSY;FBTYPE=BUSY:20260310T100000Z/20260310T110000Z"),
511 "{data}"
512 );
513 assert!(!data.contains("20260310T120000Z"), "{data}");
514 assert!(answers[1].1.starts_with("3.7"), "{answers:?}");
515 assert!(answers[2].1.starts_with("5.2"), "{answers:?}");
516
517 // Only for the own addresses.
518 let r = pim
519 .req("alice", "POST", outbox, &headers, &request(&addr("bob")))
520 .await;
521 assert_eq!(r.status, StatusCode::FORBIDDEN);
522 assert!(error_condition(&r).is(CALDAV, "organizer-allowed"));
523}
524
525#[tokio::test]
526async fn rooms_answer_from_their_bookings() {
527 let pim = Pim::new().await;
528 pim.room().await;
529 let slot = future(30, 10);
530 let alice_event = format!("{}a1.ics", cal("alice"));
531 pim.put_ok(
532 "alice",
533 &alice_event,
534 &booking("a1", "alice", &slot, "", &[ROOM]),
535 )
536 .await;
537 let org = pim.get("alice", &alice_event).await;
538 assert_eq!(
539 attendee_param(&org, ROOM, "PARTSTAT").as_deref(),
540 Some("ACCEPTED"),
541 "{org}"
542 );
543 assert!(
544 pim.inbox("alice")
545 .await
546 .iter()
547 .any(|m| m.contains("METHOD:REPLY"))
548 );
549
550 // A second meeting in the same slot is turned down.
551 let carol_event = format!("{}c1.ics", cal("carol"));
552 pim.put_ok(
553 "carol",
554 &carol_event,
555 &booking("c1", "carol", &slot, "", &[ROOM]),
556 )
557 .await;
558 let org = pim.get("carol", &carol_event).await;
559 assert_eq!(
560 attendee_param(&org, ROOM, "PARTSTAT").as_deref(),
561 Some("DECLINED"),
562 "{org}"
563 );
564
565 // Cancelling the first frees the slot for the next request.
566 let r = pim.req("alice", "DELETE", &alice_event, &[], "").await;
567 assert_eq!(r.status, StatusCode::NO_CONTENT);
568 let renamed = booking("c1", "carol", &slot, "SUMMARY:Again\r\n", &[ROOM]);
569 pim.put_ok("carol", &carol_event, &renamed).await;
570 let org = pim.get("carol", &carol_event).await;
571 assert_eq!(
572 attendee_param(&org, ROOM, "PARTSTAT").as_deref(),
573 Some("ACCEPTED"),
574 "{org}"
575 );
576
577 // A series declines only the instance that collides.
578 pim.put_ok(
579 "carol",
580 &format!("{}c2.ics", cal("carol")),
581 &booking("c2", "carol", &future(67, 9), "", &[ROOM]),
582 )
583 .await;
584 let bob_event = format!("{}b1.ics", cal("bob"));
585 let weekly = booking(
586 "b1",
587 "bob",
588 &future(60, 9),
589 "RRULE:FREQ=WEEKLY;COUNT=3\r\n",
590 &[ROOM],
591 );
592 pim.put_ok("bob", &bob_event, &weekly).await;
593 let org = pim.get("bob", &bob_event).await;
594 assert!(
595 org.contains(&format!("RECURRENCE-ID:{}", future(67, 9))),
596 "{org}"
597 );
598 let answers = |partstat: &str| {
599 org.lines()
600 .filter(|l| l.ends_with(ROOM) && l.contains(&format!("PARTSTAT={partstat}")))
601 .count()
602 };
603 assert_eq!((answers("ACCEPTED"), answers("DECLINED")), (1, 1), "{org}");
604}
605
606#[tokio::test]
607async fn sharees_schedule_only_when_allowed() {
608 let pim = Pim::new().await;
609 let alice = login(&pim.env, "alice", PW).await;
610 let listed = alice.get("/api/pim/collections").await.json();
611 let id = listed
612 .as_array()
613 .unwrap()
614 .iter()
615 .find(|c| c["kind"] == "calendar" && c["mode"].is_null())
616 .unwrap()["id"]
617 .as_i64()
618 .unwrap();
619 let shares = format!("/api/pim/collections/{id}/shares");
620 let lend = |mode: &'static str| {
621 let alice = &alice;
622 let shares = &shares;
623 async move {
624 let r = alice
625 .post_json(shares, &json!({"user": "bob", "mode": mode}))
626 .await;
627 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
628 }
629 };
630 lend("rw").await;
631 let shared = format!("/pim/calendars/bob/shared-{id}/");
632 let invite = booking("s1", "alice", "20260401T100000Z", "", &[&addr("carol")]);
633
634 // Plain write access edits, but sends nothing as alice.
635 let r = pim
636 .req("bob", "PUT", &format!("{shared}s1.ics"), &[], &invite)
637 .await;
638 assert_eq!(r.status, StatusCode::FORBIDDEN, "{}", r.text());
639 assert!(error_condition(&r).is(DAV, "need-privileges"));
640 assert!(r.text().contains("schedule-send-invite"), "{}", r.text());
641 let plain = "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nBEGIN:VEVENT\r\nUID:p1\r\n\
642 DTSTAMP:20260101T000000Z\r\nDTSTART:20260401T120000Z\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n";
643 pim.put_ok("bob", &format!("{shared}p1.ics"), plain).await;
644
645 // With the schedule level, bob invites for alice, and says so.
646 lend("rw+schedule").await;
647 let body = "<d:propfind xmlns:d=\"DAV:\"><d:prop><d:current-user-privilege-set/></d:prop></d:propfind>";
648 let r = pim.req("bob", "PROPFIND", &shared, &[], body).await;
649 assert!(r.text().contains("schedule-send-invite"), "{}", r.text());
650 pim.put_ok("bob", &format!("{shared}s1.ics"), &invite).await;
651 let sent_by = format!("ORGANIZER;SENT-BY=\"{}\":{}", addr("bob"), addr("alice"));
652 let org = pim.get("alice", &format!("{}s1.ics", cal("alice"))).await;
653 assert!(org.contains(&sent_by), "{org}");
654 let (_, copy) = pim.copy("carol").await;
655 assert!(unfold(&copy.text()).contains(&sent_by), "{}", copy.text());
656
657 // Answering for alice needs it too.
658 lend("rw").await;
659 pim.put_ok(
660 "carol",
661 &format!("{}c9.ics", cal("carol")),
662 &booking("c9", "carol", "20260402T100000Z", "", &[&addr("alice")]),
663 )
664 .await;
665 let members = pim.members("alice", &cal("alice")).await;
666 let href = members
667 .iter()
668 .find(|h| !h.ends_with("s1.ics") && !h.ends_with("p1.ics"))
669 .unwrap();
670 let name = href.rsplit('/').next().unwrap();
671 let got = pim.get("alice", href).await;
672 let accepted = got.replace(
673 &format!("PARTSTAT=NEEDS-ACTION:{}", addr("alice")),
674 &format!("PARTSTAT=ACCEPTED:{}", addr("alice")),
675 );
676 assert_ne!(got, accepted, "{got}");
677 let r = pim
678 .req("bob", "PUT", &format!("{shared}{name}"), &[], &accepted)
679 .await;
680 assert_eq!(r.status, StatusCode::FORBIDDEN, "{}", r.text());
681 assert!(r.text().contains("schedule-send-reply"), "{}", r.text());
682 lend("rw+schedule").await;
683 pim.put_ok("bob", &format!("{shared}{name}"), &accepted)
684 .await;
685 let org = pim.get("carol", &format!("{}c9.ics", cal("carol"))).await;
686 assert_eq!(
687 attendee_param(&org, &addr("alice"), "PARTSTAT").as_deref(),
688 Some("ACCEPTED"),
689 "{org}"
690 );
691 let reply = pim.inbox("carol").await;
692 let reply = reply.iter().find(|m| m.contains("METHOD:REPLY")).unwrap();
693 assert!(
694 reply.contains(&format!("SENT-BY=\"{}\"", addr("bob"))),
695 "{reply}"
696 );
697}
698
699#[tokio::test]
700async fn one_resource_per_scheduled_uid() {
701 let pim = Pim::new().await;
702 invite(&pim, &[&addr("bob")]).await;
703 let mk = "<c:mkcalendar xmlns:d=\"DAV:\" xmlns:c=\"urn:ietf:params:xml:ns:caldav\"/>";
704 let r = pim
705 .req("alice", "MKCALENDAR", "/pim/calendars/alice/work/", &[], mk)
706 .await;
707 assert_eq!(r.status, StatusCode::CREATED);
708 let r = pim
709 .req(
710 "alice",
711 "PUT",
712 "/pim/calendars/alice/work/again.ics",
713 &[],
714 &meeting("20260301T100000Z", &[&addr("bob")]),
715 )
716 .await;
717 assert_eq!(r.status, StatusCode::FORBIDDEN, "{}", r.text());
718 assert!(error_condition(&r).is(CALDAV, "unique-scheduling-object-resource"));
719 assert!(r.text().contains(ALICE_EVENT), "{}", r.text());
720}
721