dovenest

dovenest/server/tests/api_pim_io.rs
api_pim_io.rs
⎇
Raw
1//! Public feeds, import and export of calendars and address books.
2
3mod common;
4
5use axum::http::{Method, StatusCode};
6use common::*;
7use serde_json::{Value, json};
8
9const PW: &str = "secret12345";
10const CAL: &str = "/pim/calendars/alice/default/";
11
12struct Io {
13 env: Env,
14 alice: Client,
15}
16
17impl Io {
18 async fn new() -> Self {
19 let env = Env::new().await;
20 let admin = env.admin().await;
21 create_user(&admin, "alice", PW, &[]).await;
22 create_user(&admin, "bob", PW, &[]).await;
23 let alice = login(&env, "alice", PW).await;
24 Io { env, alice }
25 }
26
27 async fn dav(&self, user: &str, verb: &str, path: &str, body: &str) -> Resp {
28 let auth = basic(user, PW);
29 // Without Depth, PROPFIND lists only the collection itself.
30 Client::new(self.env.app.clone())
31 .raw(
32 Method::from_bytes(verb.as_bytes()).unwrap(),
33 path,
34 &[("authorization", &auth), ("depth", "1")],
35 body.as_bytes().to_vec(),
36 )
37 .await
38 }
39
40 async fn anon(&self, path: &str, headers: &[(&str, &str)]) -> Resp {
41 Client::new(self.env.app.clone())
42 .raw(Method::GET, path, headers, Vec::new())
43 .await
44 }
45
46 /// The id of alice's collection with this CalDAV/CardDAV URL.
47 async fn id(&self, url: &str) -> i64 {
48 let list = self.alice.get("/api/pim/collections").await.json();
49 list.as_array()
50 .unwrap()
51 .iter()
52 .find(|c| c["url"] == url)
53 .unwrap_or_else(|| panic!("no collection {url}: {list}"))["id"]
54 .as_i64()
55 .unwrap()
56 }
57
58 async fn link(&self, id: i64, body: Value) -> String {
59 let r = self
60 .alice
61 .post_json(&format!("/api/pim/collections/{id}/links"), &body)
62 .await;
63 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
64 r.json()["path"].as_str().unwrap().to_string()
65 }
66
67 async fn import(&self, id: i64, body: &str) -> Value {
68 let r = self
69 .alice
70 .raw(
71 Method::POST,
72 &format!("/api/pim/collections/{id}/import"),
73 &[("content-type", "text/calendar")],
74 body.as_bytes().to_vec(),
75 )
76 .await;
77 assert_eq!(r.status, StatusCode::OK, "{}", r.text());
78 r.json()
79 }
80}
81
82fn event(uid: &str, summary: &str, extra: &str) -> String {
83 format!(
84 "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//t//EN\r\nBEGIN:VEVENT\r\nUID:{uid}\r\nDTSTAMP:20260101T000000Z\r\nDTSTART:20260101T100000Z\r\nSUMMARY:{summary}\r\n{extra}END:VEVENT\r\nEND:VCALENDAR\r\n"
85 )
86}
87
88#[tokio::test]
89async fn feeds() {
90 let io = Io::new().await;
91 let cal = io.id(CAL).await;
92 let book = io.id("/pim/addressbooks/alice/default/").await;
93 for uid in ["a", "b"] {
94 let r = io
95 .dav(
96 "alice",
97 "PUT",
98 &format!("{CAL}{uid}.ics"),
99 &event(
100 uid,
101 "Secret plan",
102 "BEGIN:VALARM\r\nACTION:DISPLAY\r\nTRIGGER:-PT5M\r\nEND:VALARM\r\n",
103 ),
104 )
105 .await;
106 assert_eq!(r.status, StatusCode::CREATED, "{}", r.text());
107 }
108
109 let r = io
110 .dav(
111 "alice",
112 "PUT",
113 &format!("{CAL}p.ics"),
114 &event("p", "Doctor", "CLASS:PRIVATE\r\n"),
115 )
116 .await;
117 assert_eq!(r.status, StatusCode::CREATED);
118
119 let full = io.link(cal, json!({})).await;
120 assert!(
121 full.starts_with("/feed/") && full.ends_with(".ics"),
122 "{full}"
123 );
124 let r = io.anon(&full, &[]).await;
125 assert_eq!(r.status, StatusCode::OK);
126 assert!(
127 r.header("content-type")
128 .unwrap()
129 .starts_with("text/calendar")
130 );
131 let text = r.text();
132 assert!(
133 text.contains("UID:a\r\n") && text.contains("UID:b\r\n"),
134 "{text}"
135 );
136 assert!(text.contains("X-WR-CALNAME:"));
137 assert!(text.contains("Secret plan"));
138 // A public link shows private events as busy time only.
139 assert!(
140 !text.contains("Doctor") && text.contains("SUMMARY:Busy"),
141 "{text}"
142 );
143 let etag = r.header("etag").unwrap();
144 let r = io.anon(&full, &[("if-none-match", &etag)]).await;
145 assert_eq!(r.status, StatusCode::NOT_MODIFIED);
146 // The extension is optional.
147 let bare = full.trim_end_matches(".ics");
148 assert_eq!(io.anon(bare, &[]).await.status, StatusCode::OK);
149
150 // A change gives a new ETag.
151 io.dav("alice", "PUT", &format!("{CAL}c.ics"), &event("c", "x", ""))
152 .await;
153 let r = io.anon(&full, &[("if-none-match", &etag)]).await;
154 assert_eq!(r.status, StatusCode::OK);
155
156 let busy = io.link(cal, json!({ "busy_only": true })).await;
157 let text = io.anon(&busy, &[]).await.text();
158 assert!(text.contains("SUMMARY:Busy"), "{text}");
159 assert!(
160 !text.contains("Secret plan") && !text.contains("VALARM"),
161 "{text}"
162 );
163 assert!(!text.contains("UID:a\r\n"), "UIDs are hashed: {text}");
164 // The owner's export keeps everything.
165 let export = io
166 .alice
167 .get(&format!("/api/pim/collections/{cal}/export"))
168 .await
169 .text();
170 assert!(export.contains("Doctor"));
171
172 let locked = io.link(cal, json!({ "password": "feedpass123" })).await;
173 let r = io.anon(&locked, &[]).await;
174 assert_eq!(r.status, StatusCode::UNAUTHORIZED);
175 assert!(r.header("www-authenticate").is_some());
176 let wrong = basic("", "nope-nope");
177 for _ in 0..3 {
178 let r = io.anon(&locked, &[("authorization", &wrong)]).await;
179 assert_eq!(r.status, StatusCode::UNAUTHORIZED);
180 }
181 let right = basic("anyone", "feedpass123");
182 assert_eq!(
183 io.anon(&locked, &[("authorization", &right)]).await.status,
184 StatusCode::OK
185 );
186
187 let expired = io
188 .link(cal, json!({ "expires_at": "2000-01-01T00:00:00Z" }))
189 .await;
190 assert_eq!(io.anon(&expired, &[]).await.status, StatusCode::GONE);
191
192 let cards = io.link(book, json!({})).await;
193 assert!(cards.ends_with(".vcf"));
194 let r = io.anon(&cards, &[]).await;
195 assert!(r.header("content-type").unwrap().starts_with("text/vcard"));
196 let r = io
197 .alice
198 .post_json(
199 &format!("/api/pim/collections/{book}/links"),
200 &json!({ "busy_only": true }),
201 )
202 .await;
203 assert_eq!(r.status, StatusCode::BAD_REQUEST);
204
205 // Only the owner sees and manages the links.
206 let bob = login(&io.env, "bob", PW).await;
207 assert_eq!(
208 bob.get(&format!("/api/pim/collections/{cal}/links"))
209 .await
210 .status,
211 StatusCode::NOT_FOUND
212 );
213 let list = io
214 .alice
215 .get(&format!("/api/pim/collections/{cal}/links"))
216 .await
217 .json();
218 assert_eq!(list.as_array().unwrap().len(), 4);
219 let first = list[0]["id"].as_i64().unwrap();
220 let r = io
221 .alice
222 .delete(&format!("/api/pim/collections/{cal}/links/{first}"))
223 .await;
224 assert_eq!(r.status, StatusCode::OK);
225 assert_eq!(io.anon(&full, &[]).await.status, StatusCode::NOT_FOUND);
226
227 // A deleted collection takes its links along.
228 let r = io
229 .dav("alice", "MKCALENDAR", "/pim/calendars/alice/work/", "")
230 .await;
231 assert_eq!(r.status, StatusCode::CREATED);
232 let work = io.id("/pim/calendars/alice/work/").await;
233 let gone = io.link(work, json!({})).await;
234 assert_eq!(io.anon(&gone, &[]).await.status, StatusCode::OK);
235 io.dav("alice", "DELETE", "/pim/calendars/alice/work/", "")
236 .await;
237 assert_eq!(io.anon(&gone, &[]).await.status, StatusCode::NOT_FOUND);
238}
239
240#[tokio::test]
241async fn import_splits_and_updates() {
242 let io = Io::new().await;
243 let cal = io.id(CAL).await;
244 let file = "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:x\r\nMETHOD:PUBLISH\r\n\
245 BEGIN:VEVENT\r\nUID:m\r\nDTSTART:20260105T100000Z\r\nRRULE:FREQ=DAILY;COUNT=3\r\nEND:VEVENT\r\n\
246 BEGIN:VEVENT\r\nUID:m\r\nRECURRENCE-ID:20260106T100000Z\r\nDTSTART:20260106T120000Z\r\nEND:VEVENT\r\n\
247 BEGIN:VEVENT\r\nDTSTART:20260107T100000Z\r\nSUMMARY:no uid\r\nEND:VEVENT\r\n\
248 BEGIN:VFREEBUSY\r\nUID:fb\r\nEND:VFREEBUSY\r\nEND:VCALENDAR\r\n";
249 let r = io.import(cal, file).await;
250 assert_eq!(r["created"], 2, "{r}");
251 assert_eq!(r["updated"], 0);
252 assert_eq!(r["skipped_total"], 1);
253 assert_eq!(r["skipped"][0]["reason"], "supported-calendar-component");
254
255 // The same file again updates, also the event that had no UID.
256 let r = io.import(cal, file).await;
257 assert_eq!(
258 (r["created"].as_i64(), r["updated"].as_i64()),
259 (Some(0), Some(2))
260 );
261
262 let r = io.dav("alice", "PROPFIND", CAL, "").await;
263 let listing = r.text();
264 assert_eq!(listing.matches(".ics</").count(), 2, "{listing}");
265 let export = io
266 .alice
267 .get(&format!("/api/pim/collections/{cal}/export"))
268 .await;
269 let text = export.text();
270 assert!(!text.contains("METHOD"));
271 assert!(text.contains("RECURRENCE-ID:20260106T100000Z"));
272 assert!(text.contains("DTSTAMP:"), "import adds DTSTAMP: {text}");
273}
274
275#[tokio::test]
276async fn import_sends_nothing_and_keeps_uniqueness() {
277 let io = Io::new().await;
278 let cal = io.id(CAL).await;
279 let meeting = event(
280 "meet",
281 "Meeting",
282 "ORGANIZER:mailto:alice@filebrowser.invalid\r\nATTENDEE:mailto:bob@filebrowser.invalid\r\n",
283 );
284 let r = io.import(cal, &meeting).await;
285 assert_eq!(r["created"], 1, "{r}");
286 // Stored as a scheduling object, with a Schedule-Tag like after a PUT.
287 let listing = io.dav("alice", "PROPFIND", CAL, "").await.text();
288 let href = listing
289 .split("<d:href>")
290 .filter_map(|s| s.split("</d:href>").next())
291 .find(|h| h.ends_with(".ics"))
292 .unwrap_or_else(|| panic!("{listing}"))
293 .to_string();
294 let r = io.dav("alice", "GET", &href, "").await;
295 assert!(r.header("schedule-tag").is_some());
296 // bob got neither a copy nor a message.
297 for path in ["/pim/calendars/bob/default/", "/pim/calendars/bob/inbox/"] {
298 let r = io.dav("bob", "PROPFIND", path, "").await;
299 assert!(!r.text().contains(".ics</"), "{path}: {}", r.text());
300 }
301
302 // One scheduling object per UID and owner (RFC 6638, 3.2.4.1).
303 io.dav("alice", "MKCALENDAR", "/pim/calendars/alice/work/", "")
304 .await;
305 let work = io.id("/pim/calendars/alice/work/").await;
306 let r = io.import(work, &meeting).await;
307 assert_eq!(r["created"], 0);
308 assert_eq!(r["skipped"][0]["uid"], "meet");
309 assert_eq!(
310 r["skipped"][0]["reason"],
311 "unique-scheduling-object-resource"
312 );
313
314 // A read-only loan cannot be imported into.
315 let bob = login(&io.env, "bob", PW).await;
316 io.alice
317 .post_json(
318 &format!("/api/pim/collections/{cal}/shares"),
319 &json!({ "user": "bob", "mode": "ro" }),
320 )
321 .await;
322 let r = bob
323 .raw(
324 Method::POST,
325 &format!("/api/pim/collections/{cal}/import"),
326 &[("content-type", "text/calendar")],
327 event("x", "x", "").into_bytes(),
328 )
329 .await;
330 assert_eq!(r.status, StatusCode::FORBIDDEN);
331 // But exported.
332 let r = bob.get(&format!("/api/pim/collections/{cal}/export")).await;
333 assert_eq!(r.status, StatusCode::OK);
334}
335
336#[tokio::test]
337async fn export_round_trip() {
338 let io = Io::new().await;
339 let cal = io.id(CAL).await;
340 io.import(cal, &event("r1", "One", "")).await;
341 io.import(cal, &event("r2", "Two", "")).await;
342
343 let url = format!("/api/pim/collections/{cal}/export");
344 let r = io.alice.get(&url).await;
345 assert_eq!(r.status, StatusCode::OK);
346 let disposition = r.header("content-disposition").unwrap();
347 assert!(disposition.starts_with("attachment;") && disposition.contains(".ics"));
348 let exported = r.text();
349 // Download only: there is no saving into a folder.
350 let r = io.alice.post_json(&url, &json!({})).await;
351 assert_eq!(r.status, StatusCode::METHOD_NOT_ALLOWED);
352
353 // The export imports back as the same objects.
354 io.dav("alice", "MKCALENDAR", "/pim/calendars/alice/copy/", "")
355 .await;
356 let copy = io.id("/pim/calendars/alice/copy/").await;
357 let r = io.import(copy, &exported).await;
358 assert_eq!(r["created"], 2, "{r}");
359
360 // vCards, one without UID.
361 let book = io.id("/pim/addressbooks/alice/default/").await;
362 let cards = "BEGIN:VCARD\r\nVERSION:3.0\r\nUID:c1\r\nFN:One\r\nEND:VCARD\r\n\
363 BEGIN:VCARD\r\nVERSION:4.0\r\nFN:Two\r\nEND:VCARD\r\n";
364 let r = io.import(book, cards).await;
365 assert_eq!(r["created"], 2, "{r}");
366 let r = io.import(book, cards).await;
367 assert_eq!(r["updated"], 2, "{r}");
368
369 // The system address book has no collection id of its own.
370 let r = io.alice.get("/api/pim/system/export").await;
371 assert_eq!(r.status, StatusCode::OK);
372 assert!(r.header("content-disposition").unwrap().contains(".vcf"));
373 assert!(r.text().contains("FN:alice"));
374}
375