cal-invite 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a0ff2de747c18b6c294b6b9a53678ac1199a749a11be93bab4af93b8ab4617d
-  data.tar.gz: c08188280a75f0015bfee4f2cd8f896db4ac2294c7df4826bf63e1f72a05e6db
+  metadata.gz: 2a320d848302c940f549394fa7d2d76c2160415efa3eb4ef007e3613c9ef9196
+  data.tar.gz: 25bd69ff530c5b2479c0ac5f23862618089384c53994a10eaec3c8e3b59b8ce3
 SHA512:
-  metadata.gz: 83cd15e9cbf2aa3360e353aaf7fcd893fdd73d003a8de959b5c3258230560e4b3d56df060e6589fa3661945471393c085990d0d45628443b08b3eec3fad258db
-  data.tar.gz: f0d296b4789394ded4394f884b8a26c3041e47af5b16c7e7891b4317565fb35c72726788f95ce73ec0b7247816c18b4c253534f062535076022c5d337888706b
+  metadata.gz: dd3569a38b9f741d27dfe5964b98223e425539e94bca9e3a6c90b5f1baa1a2d390af7935d39c3fb04ab1272bf9d501ab3759b867d8926bc287f2019ece5021bf
+  data.tar.gz: fc43475e14f1eb253319de3d671288a261fe296b006e4807b388cfbc96707738e36f15ed0a4e1e0698afed32d5a67cd0adf3fcb36bb19fee6c8b001ec72b536c

data/.rdoc_options

@@ -1,8 +1,7 @@
 ---
 encoding: UTF-8
-static_path: ["./doc/images"]
 charset: UTF-8
-exclude: ["vendor/*", "tmp/*", ".*/*"]
+exclude: ["vendor/*", "tmp/*"]
 hyperlink_all: true
 line_numbers: true
 locale: en

data/AGENTS.md

@@ -21,26 +21,31 @@ Tests are Minitest-based, files live under `test/cal_invite/`, named `*_test.rb`
 
 ## Architecture
 
-- **`CalInvite` module** (`lib/cal_invite.rb`) — top-level entry point. Holds a singleton `CalInvite.configuration` (a `Configuration` instance) set via `CalInvite.configure { |c| ... }`. Mixes in `Caching` at the module level for class-level cache helpers.
+- **`CalInvite` module** (`lib/cal_invite.rb`) — top-level entry point. Holds a singleton `CalInvite.configuration` (a `Configuration` instance) set via `CalInvite.configure { |c| ... }`.
 
-- **`CalInvite::Event`** (`lib/cal_invite/event.rb`) — the central object. Holds all event attributes (title, start/end time, location, url, attendees, timezone, notes, multi-day sessions, all-day flag). `generate_calendar_url(provider)` is the main API: it validates the event, checks the cache (MD5 hash of all attributes + provider as key), and if not cached, resolves `CalInvite::Providers::<CapitalizedProvider>`, instantiates it with `self`, and calls `#generate`. Location and virtual-meeting URL are intentionally separate fields (not merged) so each provider can format them appropriately.
+- **`CalInvite::Event`** (`lib/cal_invite/event.rb`) — the central object. Holds all event attributes (title, start/end time, location, url, attendees, timezone, notes, multi-day sessions, all-day flag). `generate_calendar_url(provider)` is the main API: it validates the event, resolves `CalInvite::Providers::<CapitalizedProvider>`, instantiates it with `self`, and calls `#generate`. The gem deliberately caches **nothing** (output caching and the cache helpers were removed in 0.3.0; see CONFIGURATION.md's `generate_calendar_url` section for why) — don't reintroduce it. Location and virtual-meeting URL are intentionally separate fields (not merged) so each provider can format them appropriately.
 
 - **`CalInvite::Providers`** (`lib/cal_invite/providers.rb`) — namespace with `SUPPORTED_PROVIDERS = %i[google ical outlook yahoo ics office365]`. Provider classes are autoloaded from `lib/cal_invite/providers/*.rb`. To add a new provider: create a class extending `BaseProvider`, implement `#generate`, register it here with `autoload`, and add its symbol to `SUPPORTED_PROVIDERS`.
 
-- **`BaseProvider`** (`lib/cal_invite/providers/base_provider.rb`) — abstract base class (note: it's a top-level `class BaseProvider`, not namespaced under `CalInvite::Providers`). Defines the `#generate` contract (must raise `NotImplementedError` if not overridden) plus shared helpers used by subclasses: `url_encode`, `format_description`, `format_location`, `format_url`, `format_description_with_url`, `add_optional_params`, `attendees_list`. Each concrete provider (`Google`, `Outlook`, `Office365`, `Yahoo`, `Ical`, `Ics`) builds a provider-specific URL or content string from the `Event` using these helpers.
+- **`CalInvite::Providers::BaseProvider`** (`lib/cal_invite/providers/base_provider.rb`) — abstract base class. A deprecated top-level `::BaseProvider` alias (defined in `providers.rb` via `Object.deprecate_constant`, skipped if the host app already has a `BaseProvider`) remains until 0.4.0 — don't reference it from gem code. Defines the `#generate` contract (must raise `NotImplementedError` if not overridden) plus shared helpers used by subclasses: URL-building (`url_encode`, `format_description`, `format_location`, `format_url`, `format_description_with_url`, `add_optional_params`) and iCalendar property formatting (`attendees_list`, `attendee_emails`, `attendee_hash_value`, `attendee_line`, `organizer_line`, `method_value`, `status_line`, `geo_line`, `transp_line`, `busystatus_line`, `class_line`, `importance_lines`, `disallow_counter_line`, `rrule_line`, `valarm_lines`, `local_wall_time`, `vtimezone_lines`). `attendee_hash_value(attendee, key)` is the correct way to read an attendee-hash field (tries symbol then string key) — don't reintroduce `attendee[:key] || attendee["key"]`, which silently drops explicit `false` values. Each concrete provider (`Google`, `Outlook`, `Office365`, `Yahoo`, `Ical`, `Ics`) builds a provider-specific URL or content string from the `Event` using these helpers.
 
-- **`Ics` / `IcsContent` providers** (`ics.rb`, `ics_content.rb`) — generate actual `.ics` file content (RFC 5545) rather than a URL, for direct download flows (see README's `send_data` controller example). `IcsDownload` is aliased to `IcsContent` via autoload.
+- **`Ics` / `IcsContent` providers** (`ics.rb`, `ics_content.rb`) — generate actual `.ics` file content (RFC 5545) rather than a URL, for direct download flows (see README's `send_data` controller example). `Ics` is the **only** `.ics` generator: `Ical` and `IcsContent` are empty subclasses kept for their public names, so make content changes in `ics.rb` only. `IcsDownload` (HTTP header/filename helpers) lives in `ics_content.rb` alongside `IcsContent` (not an alias). All ics-family providers accept a `method:` (`:publish`/`:request`/`:cancel`/`:reply`/`:counter`/`:decline_counter`) passed through `Event#generate_calendar_url`. Use `BaseProvider#method_value` (not `method.to_s.upcase`) when emitting the `METHOD:` line — `:decline_counter` must render as `METHOD:DECLINECOUNTER` (one word) per RFC 5545, unlike its Ruby symbol. `:request` plus `Event#organizer` produces an RFC 5545 meeting request that mail clients render with RSVP actions; `:cancel` (reusing the same `Event#uid`, with `Event#sequence` bumped) produces a real cancellation; `:reply`/`:counter`/`:decline_counter` all omit `RSVP=TRUE` on `ATTENDEE` lines (none of them request a further response). `Event#uid` is stable (auto-generated and memoized per instance, or pass your own) — required so a later `:request`/`:cancel` is recognized as updating the original invite rather than creating a new one. `Event#attendees` entries can be plain email strings or `{ email:, name:, partstat:, rsvp: }` hashes (`partstat:` drives `PARTSTAT=` on the `ATTENDEE` line, default `NEEDS-ACTION`; `rsvp:` overrides the method-derived `RSVP=TRUE`/absent default — needed for e.g. a registration-confirmation invite where the attendee is already `:accepted` and `rsvp: false` suppresses it under `method: :request`). Optional `Event` fields `geo`, `reminders`, `busy`, `visibility`, `rrule`, `calendar_name` map to `GEO:`, `VALARM`, `TRANSP:`, `CLASS:`, `RRULE:`, and `X-WR-CALNAME` respectively; `importance`/`allow_counter` map to Outlook's non-standard `X-MICROSOFT-CDO-IMPORTANCE`/`X-MICROSOFT-DISALLOW-COUNTER` (plus standard `PRIORITY:` and `X-MICROSOFT-CDO-BUSYSTATUS` alongside `TRANSP:`) — safe to always emit since unrecognized `X-` properties are required to be ignored by other clients. See `CONFIGURATION.md`.
+- **Timezones** — `:ics`/`:ical` build a real `VTIMEZONE` (via `CalInvite::IcalTimezone`, backed by `tzinfo`) for any recognized IANA `timezone` other than `'UTC'`, and correctly convert `start_time`/`end_time` (always UTC) to that zone's local wall-clock time for `DTSTART;TZID=...`. `'UTC'` uses plain `Z`-suffixed timestamps with no `VTIMEZONE`. `Event#validate!` rejects any other `timezone` (`IcalTimezone.valid?`), so providers can rely on it being UTC or a real IANA zone.
 
-- **`Caching`** (`lib/cal_invite/caching.rb`) — an `ActiveSupport::Concern` mixed into `CalInvite` at the class level. Provides `fetch_from_cache`, `write_to_cache`, `read_from_cache`, `clear_cache!`, `clear_event_cache!`, `clear_provider_cache!`, all keyed under `CalInvite.configuration.cache_prefix`. Works with any `ActiveSupport::Cache::Store`-compatible store, or a custom object responding to `read`/`write`/`delete`. See also `CACHING.md`.
-
-- **`Configuration`** (`lib/cal_invite/configuration.rb`) — holds `cache_store`, `cache_prefix` (default `'cal_invite'`), `cache_expires_in` (default 24 hours), `webhook_secret`, `timezone` (default `'UTC'`). `cache_store=` accepts `:memory_store`, `:null_store`, or any object implementing `read`/`write`/`delete`.
+- **`Configuration`** (`lib/cal_invite/configuration.rb`) — holds `webhook_secret` and `timezone` (default `'UTC'`; the default `Event#timezone` when `timezone:` isn't passed). `cache_store`/`cache_prefix`/`cache_expires_in` are deprecated no-ops kept until 0.4.0: their setters warn (`uplevel: 2`, so the warning points at the caller's initializer) but still store the value so app code reading them keeps working.
 
 ## Conventions
 
 - Always pass times to `Event.new` in UTC; use the `timezone` attribute only to control display/formatting in the generated invite.
+- **Treat every `Event` attribute as untrusted input** (host apps pass end-user strings: titles, display names, ...). In `.ics` output: TEXT values go through `Ics#escape_text`; parameter values (e.g. `CN=`) through `BaseProvider#quoted_param` (RFC 6868); enumerated/numeric values are whitelisted or coerced (`class_line`, `geo_line`, `sequence_line`); and `Ics#ensure_single_line_values!` raises on any CR/LF left in a content line — never bypass it or interpolate a raw attribute into a property/parameter. URL providers must pass every value through `url_encode`. Add a case to `test/cal_invite/ics_security_test.rb` for any new property.
 - `location` (physical) and `url` (virtual meeting link) are kept as distinct fields throughout the provider layer — don't conflate them when adding provider logic.
-- All-day events skip `start_time`/`end_time` validation; multi-day events use the separate `multi_day_sessions` array instead of `start_time`/`end_time`.
+- All-day events skip `start_time`/`end_time` validation; multi-day events use the separate `multi_day_sessions` array instead of `start_time`/`end_time`. `Event#start_time`/`#end_time` are readers that fall back to the earliest session start / latest session end when not set explicitly (computed on read, so they follow `update_attributes`), which is what single-range URL providers use.
 - YARD-style doc comments (`@param`, `@return`, `@example`) are used throughout `lib/` and feed the RDoc-generated docs published to GitHub Pages (`.github/workflows/documentation.yml`) — keep them accurate when changing public method signatures.
+- CalInvite is outbound-only: it renders `.ics` content/URLs and has no concept of inbound RSVP replies. It also can't express Google/Microsoft Calendar-API-only concepts like guest permissions (`guestsCanInviteOthers` etc.) since those have no `.ics`/URL representation at all — but it does generate the genuinely protocol-level equivalents that exist: `METHOD:COUNTER`/`DECLINECOUNTER` and Outlook's `X-MICROSOFT-*` extensions (`allow_counter`, `importance`, `busy`). See CONFIGURATION.md's "Tracking RSVPs" and "Guest permissions" sections for the full breakdown of what's real vs. not addable, and why.
+
+## Example app (`Example/calendar_app`)
+
+Rails 8.1 app demonstrating the gem. Its Gemfile depends on the **published** `cal-invite` gem (never commit it pointing at `path: "../.."`) — when testing example-app changes that rely on unreleased gem code, temporarily uncomment the `path: "../.."` line locally, `bundle install`, test, then revert the Gemfile and re-run `bundle install` against rubygems before committing. `Meeting`/`MeetingAttendee` (with a migration) is a working reference implementation of the `uid`/`sequence` persistence pattern CONFIGURATION.md describes — see `app/models/meeting.rb`, `app/controllers/meetings_controller.rb` (create/reschedule/cancel), and `app/controllers/event_replies_controller.rb` (illustrative inbound `METHOD:REPLY` parsing, not wired to a real inbound-email provider).
 
 ## PRs & commits
 

data/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Cal Invite
 
+## [v0.3.0] - 2026-10-22
+
+### Upgrading from 0.2.x
+
+These changes can break existing callers:
+
+- **Unknown `Event` attributes raise.** `Event.new` and `Event#update_attributes` raise `ArgumentError` (`Unknown attribute(s): locaton`) for keys that aren't `Event` attributes, instead of silently ignoring them. If you pass a whole params hash, slice it first. A rejected `update_attributes` leaves the event unchanged. (#10)
+- **`timezone` is validated.** It must be `'UTC'` or an IANA identifier known to tzinfo (e.g. `'America/New_York'`); anything else, including raw offsets like `'+01:00'`, raises `ArgumentError`. Such values previously produced invalid `.ics` (a `TZID=` with no `VTIMEZONE`, times shifted by the offset) and could inject parameters. (#7)
+- **Time order is validated.** `ArgumentError` when `end_time` isn't after `start_time` (all-day events may end on the same date), or a `multi_day_sessions` entry is missing a time or ends before it starts. (#9)
+- **Provider names are validated.** `generate_calendar_url` raises `ArgumentError` listing the supported providers for anything outside `CalInvite::Providers::SUPPORTED_PROVIDERS` (`:ics_content` still works as an alias of `:ics`). Previously e.g. `:string` resolved Ruby's `String` and failed confusingly. (#11)
+- **`config.timezone` is now honored** as the default `Event#timezone` when `timezone:` isn't passed, as documented. If you set it to something other than `'UTC'`, your events now render in that zone. An explicit `timezone:` still wins. (#22)
+- **No more blanket `active_support/core_ext`.** Requiring `cal_invite` no longer monkey-patches core classes (`Integer#hours`, `Object#blank?`, `String#squish`, ...) in non-Rails apps. Plain-Ruby code that used those only because `cal_invite` loaded them must `require "active_support/core_ext"` (or the specific file). Rails apps are unaffected. This also lets the gem load with ActiveSupport 6.0 on Ruby 4.0. (#15)
+
+### Removed
+
+- **Output caching.** `generate_calendar_url` builds its output fresh on every call and never touches a cache store; `update_attributes` no longer wipes every event's cache entries. The cache ignored `cache_prefix`, almost never hit, froze `.ics` `DTSTAMP`, and cost more than regenerating. Output is unchanged. To cache anyway, do it in your app; CONFIGURATION.md has an example. (#14)
+- **Cache helpers.** `CalInvite.fetch_from_cache`, `write_to_cache`, `read_from_cache`, `clear_cache!`, `clear_event_cache!`, `clear_provider_cache!` and `CalInvite::Caching` are gone. They had never worked (every call raised `NoMethodError`). `CACHING.md` is gone too. (#32)
+
+### Deprecated (removed in 0.4.0)
+
+- **`config.cache_store=`, `cache_prefix=`, `cache_expires_in=`** have no effect. They print `warning: [cal_invite] Configuration#cache_store= is deprecated and has no effect ...` pointing at your initializer line, but still store the value, so code that reads them keeps working. Delete them from your initializer. (#32)
+- **`::BaseProvider`.** The provider base class is now `CalInvite::Providers::BaseProvider`, so the gem no longer owns a top-level constant that can collide with your app's. `::BaseProvider` remains as an alias (not defined at all if your app has its own `BaseProvider`). Ruby prints `constant ::BaseProvider is deprecated` when deprecation warnings are enabled (e.g. `RUBYOPT=-W:deprecated`). (#13)
+
+### Security
+
+- **Fix content-line/parameter injection in `.ics` output** (`:ics`, `:ical`, `IcsContent`). A CR or LF in event attributes (title, description, attendee/organizer names and emails, `uid`, `rrule`, `visibility`, `geo`, ...), or a `"` in a display name, could add arbitrary properties to a generated invite (e.g. extra attendees, a different `METHOD:`). URL providers were not affected. (#5)
+  - TEXT values are escaped per RFC 5545 (backslashes were previously left unescaped and lone `\r` passed through).
+  - `CN=` display names are quoted and escaped per RFC 6868.
+  - `URL:` is no longer TEXT-escaped (it's a URI; commas and semicolons in links were being corrupted).
+  - Values that can't be escaped raise `ArgumentError` if they contain a line break. `visibility` must be `:public`/`:private`/`:confidential`, `geo` numeric, and `sequence` an integer.
+- `SECURITY.md`: real policy (supported versions, private reporting via GitHub Security Advisories).
+
+### Added
+
+- `organizer:` accepts a plain email string (`organizer: "jane@example.com"`), like `attendees`; a string previously crashed `.ics` generation with `TypeError`. String-keyed hashes are read too. (#12)
+- Multi-day events no longer need top-level `start_time`/`end_time`: they default to the earliest session start and latest session end, so the README's multi-day example works. `:google`/`:outlook`/`:office365` show the overall span; `:ics`/`:ical`/`:yahoo` still emit one entry per session. Explicit times win. (#24)
+
+### Fixed
+
+- `.ics` content lines longer than 75 octets are folded (RFC 5545 §3.1), never splitting a multi-byte UTF-8 character. Long lines could be mangled or rejected by Outlook and mail gateways. (#6)
+- `'UTC'` events emit `Z`-suffixed `DTSTART`/`DTEND` instead of `TZID=UTC` with no `VTIMEZONE`. (#7)
+- `:ical` and `IcsContent` now produce exactly the same content as `:ics`. `IcsContent` previously emitted UTC-only times with no `VTIMEZONE`, ignored `notes`, and didn't support all-day events. `:ics` all-day events without times default to today, as `:ical` did. (#4)
+- Non-UTC timezones under tzinfo 1.x (Rails/ActiveSupport 6.0): `:ics`/`:ical` raised `NoMethodError` (`to_local`) and silently omitted `VTIMEZONE`. (#17)
+- `Event.new` no longer mutates the attributes hash passed in (it used to delete several keys from it, so reusing the hash dropped them). (#8)
+
+### Docs
+
+- README "Testing" section covers `rake test`, `bin/console`, and the Example app's local-path Gemfile workflow. `CLAUDE.md` merged into `AGENTS.md`.
+
+## [v0.2.1] - 2026-08-10
+
+- `:google` provider: honor `Event#attendees`/`show_attendees` (`add=`), `Event#timezone` (`ctz=`), `Event#rrule` (`recur=`), and `Event#busy` (`crm=BUSY`/`AVAILABLE`) in the generated Google Calendar URL — these were already modeled on `Event` for the ics providers but never wired into `:google`.
+- `:outlook`/`:office365` providers: honor `Event#busy` via `freebusy=`.
+- `:outlook`/`:office365` providers: fix stale deep-link URLs. Switched from the legacy `outlook.live.com/calendar/0/action/compose` and `outlook.office.com/owa/` hosts to the currently documented `outlook.live.com/calendar/deeplink/compose` and `outlook.office.com/calendar/deeplink/compose`, and added the required `rru=addevent` param.
+- CI: fix Rails 6 + Ruby 3.3/3.4 test failures (missing `logger`/`mutex_m`/`bigdecimal` requires), fix RDoc doc generation (stale `.rdoc_options` crashing the darkfish generator and silently excluding all of `lib/`), and fix a GitHub Pages deploy deadlock (duplicate `concurrency: group: "pages"` between `main.yml` and the reusable `documentation.yml`).
+
 ## [v0.2.0] - 2026-08-09
 
 - Add `Event#organizer` and a `method:` option (`:publish`/`:request`/`:cancel`) to `generate_calendar_url`, so ics/ical output can carry `METHOD:REQUEST`/`METHOD:CANCEL` + `ORGANIZER`/`SEQUENCE`/`STATUS`, matching what mail clients (Gmail, Outlook, Apple Mail) need to render an attached `.ics` as an RSVP-capable meeting invite (or a real cancellation) rather than a plain file

data/CONFIGURATION.md

@@ -2,8 +2,6 @@
 
 Complete reference for every configurable option in CalInvite: `Event` attributes, providers, the `generate_calendar_url` call, ICS/email-invite delivery, and global `CalInvite.configure` settings.
 
-For caching-specific detail, see [CACHING.md](CACHING.md).
-
 ## Table of Contents
 
 - [Event attributes](#event-attributes)
@@ -22,23 +20,23 @@ For caching-specific detail, see [CACHING.md](CACHING.md).
 
 ## Event attributes
 
-All attributes are set via `CalInvite::Event.new(attributes)` or `event.update_attributes(attributes)`.
+All attributes are set via `CalInvite::Event.new(attributes)` or `event.update_attributes(attributes)` (symbol or string keys). Any key not listed below raises `ArgumentError` (`Unknown attribute(s): ...`); `update_attributes` checks all keys before changing anything.
 
 | Attribute             | Type            | Required                              | Default | Notes |
 |------------------------|-----------------|----------------------------------------|---------|-------|
 | `title`                | `String`        | yes                                    | —       | Non-blank. |
 | `start_time`           | `Time`          | yes, unless `all_day` or using `multi_day_sessions` | — | Always pass UTC. |
-| `end_time`             | `Time`          | yes, unless `all_day` or using `multi_day_sessions` | — | Always pass UTC. |
+| `end_time`             | `Time`          | yes, unless `all_day` or using `multi_day_sessions` | — | Always pass UTC. Must be after `start_time` (`ArgumentError` otherwise); all-day events may end on the same date they start. |
 | `description`          | `String`        | no                                     | `nil`   | Plain text; combined with `notes` in provider output. |
 | `location`             | `String`        | no                                     | `nil`   | Physical location only. Kept separate from `url` so each provider formats it correctly. |
 | `url`                  | `String`        | no                                     | `nil`   | Virtual meeting link (Zoom, Meet, Teams, etc). Kept separate from `location`. |
 | `attendees`            | `Array<String, Hash>` | no                               | `nil`   | Email strings, or `{ email:, name:, partstat:, rsvp: }` hashes for a display name (`CN=`), a specific RSVP status, and/or an explicit `RSVP=` override. Only emitted if `show_attendees` is `true`. `partstat` is one of `:accepted`, `:declined`, `:tentative`, `:needs_action` (default), `:delegated`. `rsvp:` defaults to `true` for `:request`/`:cancel`/`:publish` and `false` for `:reply`/`:counter`/`:decline_counter`; set it explicitly to override (e.g. `rsvp: false` on an already-`:accepted` attendee in a registration-confirmation invite — see [Replicating a ticketing-platform confirmation email](#replicating-a-ticketing-platform-confirmation-email)). |
 | `show_attendees`       | `Boolean`       | no                                     | `false` | Gate for including `attendees` in generated output. |
-| `organizer`             | `Hash`          | no, but required for `method: :request` | `nil`   | `{ name: "Jane Doe", email: "jane@example.com" }`. `name` is optional. See [Email meeting invites](#email-meeting-invites-rsvp-capable). |
-| `timezone`             | `String`        | no                                     | `'UTC'` | Controls display/formatting only — does not affect how `start_time`/`end_time` are interpreted. Any IANA identifier (e.g. `'America/New_York'`) produces a correctly converted `DTSTART;TZID=...` plus a full `VTIMEZONE` block; see [Timezones and VTIMEZONE](#timezones-and-vtimezone). |
+| `organizer`             | `String`/`Hash` | no, but required for `method: :request` | `nil`   | `"jane@example.com"` or `{ name: "Jane Doe", email: "jane@example.com" }`. `name` is optional. See [Email meeting invites](#email-meeting-invites-rsvp-capable). |
+| `timezone`             | `String`        | no                                     | `CalInvite.configuration.timezone` (`'UTC'`) | Controls display/formatting only — does not affect how `start_time`/`end_time` are interpreted. Must be `'UTC'` or an IANA identifier (e.g. `'America/New_York'`), which produces a correctly converted `DTSTART;TZID=...` plus a full `VTIMEZONE` block; anything else raises `ArgumentError`. See [Timezones and VTIMEZONE](#timezones-and-vtimezone). |
 | `notes`                | `String`        | no                                     | `nil`   | Appended to the description. |
 | `all_day`              | `Boolean`       | no                                     | `false` | When `true`, `start_time`/`end_time` validation is skipped. |
-| `multi_day_sessions`   | `Array<Hash>`   | no                                     | `[]`    | `[{ start_time:, end_time: }, ...]`. Used instead of `start_time`/`end_time` for multi-session events. |
+| `multi_day_sessions`   | `Array<Hash>`   | no                                     | `[]`    | `[{ start_time:, end_time: }, ...]`. Used instead of `start_time`/`end_time` for multi-session events. Each session needs both times, with `end_time` after `start_time`. `:ics`/`:ical` emit one `VEVENT` per session and `:yahoo` one URL per session (newline-separated); `:google`/`:outlook`/`:office365` can only express one range, so they use `start_time`/`end_time`, which default to the earliest session start and latest session end (explicit values win). |
 | `uid`                  | `String`        | no                                     | randomly generated, memoized per `Event` instance | Stable RFC 5545 identifier. **Must** be reused across calls when you send an update (`:request`) or cancellation (`:cancel`) for a previously sent invite — see [Updating and cancelling invites](#updating-and-cancelling-invites). |
 | `sequence`             | `Integer`       | no                                     | `0`     | RFC 5545 SEQUENCE. Increment it yourself each time you resend a `:request`/`:cancel` for the same `uid`. |
 | `geo`                  | `Array<Float>`, `Hash` | no                              | `nil`   | `[37.4595, -122.1418]` or `{ lat:, lng: }`. Emits `GEO:lat;lng` — lets Apple/Google Maps deep-link from the invite. |
@@ -79,16 +77,16 @@ Pass one of these symbols to `generate_calendar_url`:
 
 | Symbol      | Output                          | Notes |
 |-------------|----------------------------------|-------|
-| `:google`   | Google Calendar URL             | |
-| `:outlook`  | Outlook (outlook.live.com) URL   | |
-| `:office365`| Outlook 365 URL                 | |
+| `:google`   | Google Calendar URL             | Honors `attendees`/`show_attendees` (`add=`), `timezone` (`ctz=`), `rrule` (`recur=`), `busy` (`crm=BUSY`/`AVAILABLE`). |
+| `:outlook`  | Outlook (outlook.live.com) URL   | Honors `attendees`/`show_attendees` (`to=`), `busy` (`freebusy=`). |
+| `:office365`| Outlook 365 URL                 | Honors `attendees`/`show_attendees` (`to=`), `busy` (`freebusy=`). |
 | `:yahoo`    | Yahoo Calendar URL              | |
 | `:ical`     | `.ics` content (`METHOD:PUBLISH` or `:REQUEST`) | Apple iCal / any iCalendar-compatible app |
 | `:ics`      | `.ics` content (`METHOD:PUBLISH` or `:REQUEST`) | Generic RFC 5545 file |
 
 `CalInvite::Providers::SUPPORTED_PROVIDERS` holds the full list programmatically.
 
-`CalInvite::Providers::IcsContent` is also available directly (not via `generate_calendar_url`) if you want raw `.ics` content without going through `Event#generate_calendar_url`'s caching path — see [ICS content and downloads](#ics-content-and-downloads).
+`CalInvite::Providers::IcsContent` is also available directly (not via `generate_calendar_url`) if you want raw `.ics` content without `Event#generate_calendar_url`'s validation — see [ICS content and downloads](#ics-content-and-downloads).
 
 ## `generate_calendar_url`
 
@@ -98,20 +96,26 @@ event.generate_calendar_url(provider, method: :publish)
 
 | Param     | Type     | Default    | Notes |
 |-----------|----------|------------|-------|
-| `provider`| `Symbol` | required   | One of the provider symbols above. |
+| `provider`| `Symbol` | required   | One of the provider symbols above (a String also works). Anything else raises `ArgumentError` listing the supported providers. `:ics_content` is accepted as a legacy alias of `:ics`. |
 | `method`  | `Symbol` | `:publish` | `:publish`, `:request`, `:cancel`, `:reply`, `:counter`, or `:decline_counter`. Only honored by `:ics`/`:ical` — ignored by URL-based providers. `:request` requires `organizer` to be set on the event; see below. `:cancel` requires reusing the original `uid` — see [Updating and cancelling invites](#updating-and-cancelling-invites). `:reply`/`:counter`/`:decline_counter` omit `RSVP=TRUE` on `ATTENDEE` lines — see [Attendee RSVP status and METHOD:REPLY](#attendee-rsvp-status-and-methodreply) and [Attendee-proposed reschedules (COUNTER)](#attendee-proposed-reschedules-counter). Note: `:decline_counter` renders as `METHOD:DECLINECOUNTER` (one word, per RFC 5545). |
 
-Results are cached (when caching is configured) keyed on all event attributes, `provider`, and `method` together — changing any of them produces a distinct cache entry.
+Output is generated fresh on every call. CalInvite doesn't cache anything: building the output takes microseconds, and a cached `.ics` would keep a stale `DTSTAMP`. If you want caching anyway, do it in your app, keyed on whatever identifies the content and changes with it:
+
+```ruby
+Rails.cache.fetch([meeting, meeting.sequence, :ics]) do
+  meeting.to_cal_invite_event.generate_calendar_url(:ics, method: :request)
+end
+```
 
 ## ICS content and downloads
 
 Two ways to get raw `.ics` content:
 
 ```ruby
-# Via Event (goes through validation + caching)
+# Via Event (goes through validation)
 content = event.generate_calendar_url(:ics, method: :publish)
 
-# Directly via the provider (bypasses Event caching)
+# Directly via the provider (skips Event#validate!)
 content = CalInvite::Providers::Ics.new(event, method: :publish).generate
 ```
 
@@ -331,10 +335,8 @@ A working reference implementation of this whole pattern — a `Meeting` model
 persisting `uid`/`sequence`, and controller actions that send/reschedule/cancel
 — lives in [`Example/calendar_app`](Example/calendar_app): see
 `app/models/meeting.rb` and `app/controllers/meetings_controller.rb`. It
-depends on the attendee-hash/`uid`/`sequence` features documented here, so it
-needs whatever gem version ships those (0.2.0+) — the example app's `Gemfile`
-tracks the published gem, so point it at `path: "../.."` locally if you want
-to run this demo before that release is out.
+depends on the attendee-hash/`uid`/`sequence` features documented here, which
+shipped in 0.2.0, so it runs against the published gem.
 
 ## Tracking RSVPs: what the gem does and doesn't do
 
@@ -506,20 +508,17 @@ For any `timezone` other than `'UTC'` that's a recognized IANA/Olson identifier
 timestamps with no `VTIMEZONE` block, which every calendar client understands
 unambiguously.
 
-If `timezone` isn't a recognized IANA identifier (e.g. a raw offset string like
-`'+01:00'`), both providers fall back to treating `start_time`/`end_time` as
-already being in that zone's wall-clock time — the pre-existing behavior — since
-there's no timezone database entry to convert against or build a `VTIMEZONE`
-from.
+Any other value — including raw offset strings like `'+01:00'` — raises
+`ArgumentError` from `Event.new`/`update_attributes`: there's no timezone
+database entry to convert against or build a `VTIMEZONE` from, and emitting a
+`TZID` with no matching `VTIMEZONE` is invalid RFC 5545. Use the IANA name for
+the place instead (e.g. `'Europe/Paris'`), or `'UTC'`.
 
 ## Global configuration (`CalInvite.configure`)
 
 ```ruby
 # config/initializers/cal_invite.rb
 CalInvite.configure do |config|
-  config.cache_store = Rails.cache        # or :memory_store, :null_store, or a custom read/write/delete object
-  config.cache_prefix = 'my_app_cal_invite'
-  config.cache_expires_in = 3600           # seconds
   config.webhook_secret = ENV['CAL_INVITE_WEBHOOK_SECRET']
   config.timezone = 'UTC'
 end
@@ -527,10 +526,7 @@ end
 
 | Option              | Type                                   | Default        | Notes |
 |---------------------|-----------------------------------------|----------------|-------|
-| `cache_store`       | `:memory_store`, `:null_store`, or any object implementing `read`/`write`/`delete` | `nil` (caching disabled) | See [CACHING.md](CACHING.md) for full detail. |
-| `cache_prefix`      | `String`                                | `'cal_invite'` | Namespaces cache keys. |
-| `cache_expires_in`  | `Integer` (seconds)                     | `86400` (24h)  | |
 | `webhook_secret`    | `String`                                | `nil`          | Reserved for webhook signature verification in consuming apps. |
-| `timezone`          | `String`                                | `'UTC'`        | Configuration-level default; per-event `timezone` attribute takes precedence for that event's display formatting. |
+| `timezone`          | `String`                                | `'UTC'`        | Default `timezone` for events created without one; an explicit per-event `timezone:` wins. Validated like any event timezone, so an unknown value makes `Event.new` raise `ArgumentError`. |
 
-Caching is disabled unless `cache_store` is set — without it, `generate_calendar_url` regenerates output on every call.
+`cache_store`, `cache_prefix` and `cache_expires_in` are deprecated and have no effect. Setting one prints a warning, and they'll be removed in 0.4.0, so delete them from your initializer.

data/README.md

@@ -1,6 +1,6 @@
 # 📅 CalInvite
 
-A Ruby gem for generating calendar invitations across multiple calendar platforms with caching and webhook support.
+A Ruby gem for generating calendar invitations across multiple calendar platforms with webhook support.
 
 [![Gem Version](https://badge.fury.io/rb/cal-invite.svg)](https://badge.fury.io/rb/cal-invite)
 ![Build Status](https://github.com/DashAPI-ai/cal-invite/actions/workflows/main.yml/badge.svg)
@@ -217,25 +217,9 @@ end
    - Attendees are properly formatted with RSVP options
    - Virtual meeting URLs are properly separated from physical locations
 
-## Caching Support
+## Caching
 
-CalInvite includes built-in caching support to improve performance when generating calendar URLs. To enable caching in your Rails application:
-
-```ruby
-# config/initializers/cal_invite.rb
-CalInvite.configure do |config|
-  # Use Rails cache by default
-  config.cache_store = Rails.cache
-  
-  # Optional: Set cache prefix
-  config.cache_prefix = 'my_app_cal_invite'
-  
-  # Optional: Set expiration time (in seconds)
-  config.cache_expires_in = 3600 # 1 hour
-end
-```
-
-For detailed information about configuring caching in Rails applications and available options, see our [Caching Guide](https://github.com/DashAPI-ai/cal-invite/blob/master/CACHING.md). For every other configuration option (`Event` attributes, providers, email invites), see [CONFIGURATION.md](CONFIGURATION.md).
+CalInvite doesn't cache anything. Generated URLs and `.ics` content are cheap to build and always fresh. The old `cache_store`/`cache_prefix`/`cache_expires_in` settings are deprecated no-ops (removed in 0.4.0). See [CONFIGURATION.md](CONFIGURATION.md#generate_calendar_url) for caching at your own layer, and for every other option.
 
 ## Development
 
@@ -249,13 +233,41 @@ Add test(s) as necessary.
 
 Run all the tests before submitting: `bundle exec rake test`
 
+There are three ways to exercise the gem while working on a change:
+
+**1. Unit tests** (Minitest, under `test/cal_invite/`) — use these to lock a change in:
+
+```bash
+bundle exec rake test                                      # full suite (+ SimpleCov report in coverage/)
+bundle exec rake test TEST=test/cal_invite/event_test.rb   # a single file
+```
+
+**2. Interactive console** — `bin/console` opens IRB with your local `lib/` loaded, handy for eyeballing generated URLs and `.ics` output:
+
+```ruby
+event = CalInvite::Event.new(
+  title: "Demo",
+  start_time: Time.utc(2026, 11, 1, 15),
+  end_time: Time.utc(2026, 11, 1, 16),
+  timezone: "America/New_York",
+  organizer: { email: "me@example.com", name: "Me" },
+  attendees: ["guest@example.com"],
+  show_attendees: true
+)
+
+puts event.generate_calendar_url(:ics, method: :request)  # raw .ics content
+event.generate_calendar_url(:google)                      # provider URL
+```
+
+**3. Example Rails app** (`Example/calendar_app`) — for end-to-end checks in a real browser or mail client (downloading the `.ics`, RSVP buttons, etc.). Its Gemfile points at the published gem; to test unreleased changes, temporarily swap `gem "cal-invite"` for the commented-out `gem "cal-invite", path: "../../"` line and run `bundle install`. Revert the Gemfile and re-run `bundle install` before committing.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/DashAPI-ai/cal-invite. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/DashAPI-ai/cal-invite/blob/master/CODE_OF_CONDUCT.md).
 
 ## Documentation
 
-The documentation is spread across the README, [CONFIGURATION.md](CONFIGURATION.md), [CACHING.md](CACHING.md), and the doc folder.
+The documentation is spread across the README, [CONFIGURATION.md](CONFIGURATION.md), and the doc folder.
 
 The documentation can be generated using `bundle exec rake rdoc`
 

data/SECURITY.md

@@ -2,20 +2,49 @@
 
 ## Supported Versions
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
+Security fixes are released for the latest minor version only. Please upgrade to
+the most recent release before reporting.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| 0.2.x   | :white_check_mark: |
+| < 0.2   | :x:                |
 
 ## Reporting a Vulnerability
 
-Use this section to tell people how to report a vulnerability.
+**Please do not open a public issue for security problems.**
 
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+Report vulnerabilities privately through GitHub:
+[Report a vulnerability](https://github.com/DashAPI-ai/cal-invite/security/advisories/new)
+(Security tab → "Report a vulnerability").
+
+Please include:
+
+- the affected version(s) and provider(s) (`:ics`, `:google`, ...)
+- a minimal `CalInvite::Event` that reproduces the issue, and the output you got
+- the impact you expect (e.g. injected `.ics` properties, broken URL encoding)
+
+What to expect:
+
+- an acknowledgement within 5 business days;
+- an assessment, and a fix timeline if the report is accepted, within 14 days;
+- a patched release plus a published GitHub Security Advisory (with credit, if
+  you'd like it) once a fix is available. If the report is declined, we'll
+  explain why.
+
+## Scope
+
+CalInvite turns `CalInvite::Event` attributes into calendar URLs and `.ics`
+content. Attribute values are treated as untrusted:
+
+- **URL providers** (`:google`, `:outlook`, `:office365`, `:yahoo`) URL-encode
+  every value.
+- **`.ics` providers** (`:ics`, `:ical`, `IcsContent`) escape TEXT values per
+  RFC 5545, quote and escape parameter values (e.g. `CN=`) per RFC 6868, and raise
+  `ArgumentError` rather than emit a value that would break out of its content
+  line.
+
+Anything that lets attribute values alter the structure of generated output
+(extra properties, components, parameters, or URL query parameters) is in scope.
+How the host application stores, sends, or serves the generated content (email
+delivery, HTTP headers you set yourself, etc.) is out of scope.

data/lib/cal_invite/configuration.rb

@@ -2,11 +2,11 @@
 
 # lib/cal_invite/configuration.rb
 # Configuration class for the CalInvite gem.
-# Handles all configurable options including cache settings, timezone, and webhook secrets.
+# Handles all configurable options: timezone and webhook secret.
 #
-# @attr_reader [ActiveSupport::Cache::Store, nil] cache_store The cache store to use
-# @attr_reader [String] cache_prefix The prefix to use for cache keys
-# @attr_reader [Integer] cache_expires_in The default cache expiration time in seconds
+# @attr_reader [ActiveSupport::Cache::Store, nil] cache_store Deprecated, unused; removed in 0.4.0
+# @attr_reader [String] cache_prefix Deprecated, unused; removed in 0.4.0
+# @attr_reader [Integer] cache_expires_in Deprecated, unused; removed in 0.4.0
 # @attr_reader [String, nil] webhook_secret The secret key for webhook verification
 # @attr_reader [String] timezone The default timezone for events
 module CalInvite
@@ -17,19 +17,18 @@ module CalInvite
     def initialize
       @cache_store = nil
       @cache_prefix = 'cal_invite'
-      @cache_expires_in = 24.hours # now this will work with active_support loaded
+      @cache_expires_in = 24 * 60 * 60
       @webhook_secret = nil
       @timezone = 'UTC'
     end
 
-    # Sets the cache store to use for caching calendar URLs.
+    # @deprecated CalInvite caches nothing, so this setting has no effect.
+    #   It warns, and will be removed in 0.4.0.
     #
     # @param store [Symbol, #read, #write, #delete] The cache store to use
     # @raise [ArgumentError] If an unsupported cache store is provided
-    #
-    # @example Set memory store
-    #   config.cache_store = :memory_store
     def cache_store=(store)
+      warn_deprecated_cache_setting(:cache_store)
       @cache_store = case store
       when :memory_store
         ActiveSupport::Cache::MemoryStore.new
@@ -46,17 +45,19 @@ module CalInvite
       end
     end
 
-    # Sets the prefix used for cache keys.
+    # @deprecated Has no effect; warns, and will be removed in 0.4.0.
     #
     # @param prefix [#to_s] The prefix to use for cache keys
     def cache_prefix=(prefix)
+      warn_deprecated_cache_setting(:cache_prefix)
       @cache_prefix = prefix.to_s
     end
 
-    # Sets the default cache expiration time.
+    # @deprecated Has no effect; warns, and will be removed in 0.4.0.
     #
     # @param duration [#to_i] The duration in seconds
     def cache_expires_in=(duration)
+      warn_deprecated_cache_setting(:cache_expires_in)
       @cache_expires_in = duration.to_i
     end
 
@@ -73,5 +74,13 @@ module CalInvite
     def timezone=(tz)
       @timezone = tz.to_s
     end
+
+    private
+
+    def warn_deprecated_cache_setting(name)
+      warn "[cal_invite] Configuration##{name}= is deprecated and has no effect: " \
+           "CalInvite no longer caches anything. Remove it; it will be removed in 0.4.0.",
+           uplevel: 2
+    end
   end
 end