@remit/backend 0.0.143 → 0.0.145

package/dist/src/handlers/calendar-event.js

@@ -0,0 +1,417 @@
+import { applyScopedDelete, applyScopedUpdate, buildEventCalendar, deleteCalendarObject, followingUidOf, listBusySpans, listCalendarInstances, listObjectInstances, OFFSET_BEARING, parseCalendar, prepareCalendarObject, putCalendarObject, readWrittenObject, toOffsetIso, toUtcIso, } from "@remit/calendar-service";
+import { base36uuid } from "@remit/data-ports/id";
+import { RecurrenceScope } from "@remit/domain-enums";
+import { badRequest, calendarDepsOf, findCalendarFor, findWritableCalendarFor, listCalendarsFor, notFound, preconditionFailed, refuseCalendar, } from "./calendar.js";
+/**
+ * The widest window a single read may ask for. A year covers every view the
+ * client has — a year grid is the coarsest — and keeps one request from asking
+ * the server to expand a decade of a daily series.
+ */
+export const CALENDAR_MAX_WINDOW_DAYS = 366;
+const MAX_WINDOW_MS = CALENDAR_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1000;
+export const calendarEventDepsOf = (deps) => ({
+    ...deps,
+    newId: base36uuid,
+    now: () => new Date(),
+});
+/**
+ * Reads the window a listing asked for.
+ *
+ * Both ends must carry an offset, because a window with no offset names no
+ * span of time — and a client whose `from` was read an hour out gets an
+ * apparently empty morning rather than an error.
+ */
+export const readWindow = (from, to) => {
+    if (typeof from !== "string" || typeof to !== "string") {
+        return refuseCalendar("InvalidWindow", "a listing needs both `from` and `to`");
+    }
+    const fromMs = Date.parse(from);
+    const toMs = Date.parse(to);
+    if (Number.isNaN(fromMs) ||
+        Number.isNaN(toMs) ||
+        !OFFSET_BEARING.test(from) ||
+        !OFFSET_BEARING.test(to)) {
+        return refuseCalendar("InvalidWindow", "`from` and `to` must be ISO 8601 date-times with a zone offset");
+    }
+    if (toMs <= fromMs) {
+        return refuseCalendar("InvalidWindow", "`to` must come after `from`");
+    }
+    if (toMs - fromMs > MAX_WINDOW_MS) {
+        return refuseCalendar("InvalidWindow", `a window may cover at most ${CALENDAR_MAX_WINDOW_DAYS} days`);
+    }
+    return { ok: true, value: { from: toUtcIso(fromMs), to: toUtcIso(toMs) } };
+};
+/** The collections a listing covers, defaulting to every one the caller holds. */
+export const collectionsForListing = async (deps, accountConfigId, calendarIds) => {
+    const held = await listCalendarsFor(deps, accountConfigId);
+    if (calendarIds.length === 0)
+        return { ok: true, value: held };
+    const selected = held.filter((collection) => calendarIds.includes(collection.calendarId));
+    const missing = calendarIds.find((calendarId) => !held.some((collection) => collection.calendarId === calendarId));
+    if (missing) {
+        return refuseCalendar("NotFound", `no calendar ${missing} on this account`);
+    }
+    return { ok: true, value: selected };
+};
+const toInstanceResponse = (instance) => ({
+    calendarId: instance.calendarId,
+    calendarObjectId: instance.calendarObjectId,
+    recurrenceId: instance.recurrenceId,
+    icalUid: instance.icalUid,
+    summary: instance.summary,
+    start: instance.start,
+    end: instance.end,
+    allDay: instance.allDay,
+    status: instance.status,
+    transparency: instance.transparency,
+    zoneCertainty: instance.zoneCertainty,
+    etag: instance.etag,
+    hasRecurrence: instance.hasRecurrence,
+});
+const toEventResponse = (object) => ({
+    calendarObjectId: object.calendarObjectId,
+    calendarId: object.calendarId,
+    resourceName: object.resourceName,
+    icalUid: object.icalUid,
+    icalData: object.icalData,
+    etag: object.etag,
+    sequence: object.sequence,
+    syncSequence: object.syncSequence,
+    summary: object.summary,
+    dtStart: object.dtStart,
+    dtEnd: object.dtEnd,
+    allDay: object.allDay,
+    zoneCertainty: object.zoneCertainty,
+    status: object.status,
+    transparency: object.transparency,
+    hasRecurrence: object.hasRecurrence,
+    expandedThrough: object.expandedThrough,
+    createdAt: object.createdAt,
+    updatedAt: object.updatedAt,
+});
+const eventFieldsOf = (input) => ({
+    summary: input.summary,
+    description: input.description ?? "",
+    location: input.location ?? "",
+    start: input.start,
+    end: input.end,
+    allDay: input.allDay ?? false,
+    timeZone: input.timeZone ?? "",
+    status: input.status ?? "Confirmed",
+    transparency: input.transparency ?? "Opaque",
+    recurrenceRule: input.recurrenceRule ?? "",
+});
+/**
+ * Reduce a PATCH body to the event fields an update may set, preserving
+ * absence: a body carrying only `summary` yields only `summary`, and the
+ * resource's times are then left exactly as they were.
+ */
+export const pickEventUpdate = (body) => {
+    const patch = {};
+    const fields = [
+        "summary",
+        "description",
+        "location",
+        "start",
+        "end",
+        "allDay",
+        "timeZone",
+        "status",
+        "transparency",
+        "recurrenceRule",
+    ];
+    for (const field of fields) {
+        if (!Object.hasOwn(body, field))
+            continue;
+        Object.assign(patch, { [field]: body[field] });
+    }
+    return patch;
+};
+/**
+ * Whether an `If-Match` header lets the write through.
+ *
+ * No header is no precondition, which is what HTTP says and what a first-party
+ * client that just read the resource wants. `*` matches any existing resource.
+ * Quotes and a weak-validator prefix are transport spelling and are stripped
+ * before comparing, because the stored tag carries neither.
+ */
+export const etagMatches = (ifMatch, etag) => {
+    if (ifMatch === undefined || ifMatch === "")
+        return true;
+    return ifMatch
+        .split(",")
+        .map((candidate) => candidate.trim().replace(/^W\//, "").replace(/"/g, ""))
+        .some((candidate) => candidate === "*" || candidate === etag);
+};
+/**
+ * An absent scope means the whole series, which is what a client editing an
+ * event that does not recur sends. A scope that is present but not one of the
+ * three is refused rather than read as `All`: the widest, most destructive
+ * reading is the worst possible answer to a typo.
+ */
+export const readScope = (value) => {
+    if (value === undefined || value === "") {
+        return { ok: true, value: RecurrenceScope.All };
+    }
+    if (value === RecurrenceScope.This ||
+        value === RecurrenceScope.Following ||
+        value === RecurrenceScope.All) {
+        return { ok: true, value };
+    }
+    return refuseCalendar("InvalidScope", `scope must be one of This, Following or All, and this request sent "${String(value)}"`);
+};
+/**
+ * Writes what a scoped edit resolved to.
+ *
+ * A split is two resources and one write set: the truncated original and the
+ * remainder land together or not at all, because half a split is a series the
+ * user sees twice or not at all.
+ */
+export const commitScopedWrite = async (deps, accountConfigId, object, collectionTimezone, write) => {
+    if (write.kind === "Delete") {
+        await deleteCalendarObject(deps.calendarStore, {
+            accountConfigId,
+            calendarId: object.calendarId,
+            calendarObjectId: object.calendarObjectId,
+        });
+        return { ok: true, value: null };
+    }
+    // Both resources are prepared before either is written, so a refusal of
+    // either one commits nothing: half a split is never stored.
+    const zone = { timezone: collectionTimezone };
+    const head = await prepareCalendarObject(zone, {
+        accountConfigId,
+        calendarId: object.calendarId,
+        resourceName: object.resourceName,
+        icalData: write.icalData,
+    });
+    if (!head.ok)
+        return head;
+    if (write.kind === "Replace") {
+        await deps.calendarStore.commit([head.value]);
+        return {
+            ok: true,
+            value: await readWrittenObject(deps.calendarStore, head.value),
+        };
+    }
+    const following = await prepareCalendarObject(zone, {
+        accountConfigId,
+        calendarId: object.calendarId,
+        resourceName: `${deps.newId()}.ics`,
+        icalData: write.following,
+    });
+    if (!following.ok)
+        return following;
+    await deps.calendarStore.commit([head.value, following.value]);
+    // The remainder is what the patch applied to, and it lives under an id the
+    // caller has never seen — returning the truncated head instead would leave
+    // them holding the resource their edit is not in.
+    return {
+        ok: true,
+        value: await readWrittenObject(deps.calendarStore, following.value),
+    };
+};
+export const createCalendarEventFor = async (deps, accountConfigId, input) => {
+    const collection = await findWritableCalendarFor(deps, accountConfigId, input.calendarId);
+    if (!collection.ok)
+        return collection;
+    const id = deps.newId();
+    const built = await buildEventCalendar(eventFieldsOf(input), `${id}@reader.remit`, deps.now());
+    if (!built.ok)
+        return built;
+    return putCalendarObject(deps.calendarStore, {
+        accountConfigId,
+        calendarId: collection.value.calendarId,
+        resourceName: `${id}.ics`,
+        icalData: built.value,
+    });
+};
+const resolveResource = async (deps, accountConfigId, request, intent) => {
+    const collection = intent === "write"
+        ? await findWritableCalendarFor(deps, accountConfigId, request.calendarId)
+        : await findCalendarFor(deps, accountConfigId, request.calendarId);
+    if (!collection.ok)
+        return collection;
+    const object = await deps.calendarObject.find(request.calendarId, request.calendarObjectId);
+    if (!object) {
+        return refuseCalendar("NotFound", `no event ${request.calendarObjectId} in this calendar`);
+    }
+    return { ok: true, value: { collection: collection.value, object } };
+};
+export const updateCalendarEventFor = async (deps, accountConfigId, request, patch) => {
+    const resolved = await resolveResource(deps, accountConfigId, request, "write");
+    if (!resolved.ok)
+        return resolved;
+    const { collection, object } = resolved.value;
+    if (!etagMatches(request.ifMatch, object.etag)) {
+        return refuseCalendar("EtagMismatch", "this event has been written since you read it — read it again and reapply the change");
+    }
+    const parsed = await parseCalendar(object.icalData);
+    if (!parsed.ok) {
+        throw new Error(`stored calendar object ${object.calendarObjectId} no longer parses: ${parsed.error.message}`);
+    }
+    const write = await applyScopedUpdate(parsed.value, collection.timezone, {
+        scope: request.scope,
+        recurrenceId: request.recurrenceId,
+        followingUid: followingUidOf(object.icalUid, `${deps.newId()}@reader.remit`),
+    }, patch);
+    if (!write.ok)
+        return write;
+    return commitScopedWrite(deps, accountConfigId, object, collection.timezone, write.value);
+};
+export const deleteCalendarEventFor = async (deps, accountConfigId, request) => {
+    const resolved = await resolveResource(deps, accountConfigId, request, "write");
+    if (!resolved.ok)
+        return resolved;
+    const { collection, object } = resolved.value;
+    if (!etagMatches(request.ifMatch, object.etag)) {
+        return refuseCalendar("EtagMismatch", "this event has been written since you read it — read it again and reapply the change");
+    }
+    const parsed = await parseCalendar(object.icalData);
+    if (!parsed.ok) {
+        throw new Error(`stored calendar object ${object.calendarObjectId} no longer parses: ${parsed.error.message}`);
+    }
+    const write = await applyScopedDelete(parsed.value, collection.timezone, {
+        scope: request.scope,
+        recurrenceId: request.recurrenceId,
+        followingUid: "",
+    });
+    if (!write.ok)
+        return write;
+    return commitScopedWrite(deps, accountConfigId, object, collection.timezone, write.value);
+};
+/** The collection holding a resource, found among the ones given. */
+const locateResource = async (deps, collections, calendarObjectId) => {
+    for (const collection of collections) {
+        const object = await deps.calendarObject.find(collection.calendarId, calendarObjectId);
+        if (object)
+            return { collection, object };
+    }
+    return undefined;
+};
+const readCalendarIds = (value) => {
+    if (typeof value === "string")
+        return value === "" ? [] : [value];
+    if (Array.isArray(value))
+        return value.filter((id) => typeof id === "string");
+    return [];
+};
+const answerRefusal = (error) => error.code === "NotFound"
+    ? notFound(error.message)
+    : error.code === "EtagMismatch"
+        ? preconditionFailed(error.message)
+        : badRequest(error);
+const scopedRequestOf = (context) => {
+    const params = context.request.params;
+    const query = context.request.query;
+    const scope = readScope(query.scope);
+    if (!scope.ok)
+        return scope;
+    const headers = (context.request.headers ?? {});
+    const ifMatch = Object.entries(headers).find(([name]) => name.toLowerCase() === "if-match")?.[1];
+    return {
+        ok: true,
+        value: {
+            calendarId: query.calendarId ?? "",
+            calendarObjectId: params.calendarObjectId,
+            scope: scope.value,
+            recurrenceId: query.recurrenceId ?? "",
+            ifMatch,
+        },
+    };
+};
+export const CalendarEventOperations = {
+    CalendarEventOperations_listCalendarEvents: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const query = context.request.query;
+        const window = readWindow(query.from, query.to);
+        if (!window.ok)
+            return badRequest(window.error);
+        const deps = calendarDepsOf(ctx.client);
+        const collections = await collectionsForListing(deps, accountConfigId, readCalendarIds(query.calendarId));
+        if (!collections.ok)
+            return answerRefusal(collections.error);
+        if (query.calendarObjectId) {
+            const located = await locateResource(deps, collections.value, query.calendarObjectId);
+            if (!located)
+                return { items: [] };
+            const own = await listObjectInstances(deps, located.collection, located.object, window.value);
+            return { items: own.map(toInstanceResponse) };
+        }
+        const instances = await listCalendarInstances(deps, collections.value, window.value);
+        return { items: instances.map(toInstanceResponse) };
+    },
+    CalendarEventOperations_createCalendarEvent: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const input = context.request.requestBody;
+        const deps = calendarEventDepsOf(calendarDepsOf(ctx.client));
+        const created = await createCalendarEventFor(deps, accountConfigId, input);
+        if (!created.ok)
+            return answerRefusal(created.error);
+        return toEventResponse(created.value);
+    },
+};
+export const CalendarEventDetailOperations = {
+    CalendarEventDetailOperations_getCalendarEvent: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const request = scopedRequestOf(context);
+        if (!request.ok)
+            return badRequest(request.error);
+        const deps = calendarEventDepsOf(calendarDepsOf(ctx.client));
+        if (request.value.calendarId === "") {
+            const located = await locateResource(deps, await listCalendarsFor(deps, accountConfigId), request.value.calendarObjectId);
+            if (!located) {
+                return notFound(`no event ${request.value.calendarObjectId} on this account`);
+            }
+            return toEventResponse(located.object);
+        }
+        const resolved = await resolveResource(deps, accountConfigId, request.value, "read");
+        if (!resolved.ok)
+            return answerRefusal(resolved.error);
+        return toEventResponse(resolved.value.object);
+    },
+    CalendarEventDetailOperations_updateCalendarEvent: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const body = context.request
+            .requestBody;
+        const request = scopedRequestOf(context);
+        if (!request.ok)
+            return badRequest(request.error);
+        const deps = calendarEventDepsOf(calendarDepsOf(ctx.client));
+        const updated = await updateCalendarEventFor(deps, accountConfigId, request.value, pickEventUpdate(body));
+        if (!updated.ok)
+            return answerRefusal(updated.error);
+        if (!updated.value) {
+            throw new Error("a scoped update resolved to a delete");
+        }
+        return toEventResponse(updated.value);
+    },
+    CalendarEventDetailOperations_deleteCalendarEvent: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const request = scopedRequestOf(context);
+        if (!request.ok)
+            return badRequest(request.error);
+        const deps = calendarEventDepsOf(calendarDepsOf(ctx.client));
+        const removed = await deleteCalendarEventFor(deps, accountConfigId, request.value);
+        if (!removed.ok)
+            return answerRefusal(removed.error);
+        return { statusCode: 204 };
+    },
+};
+export const CalendarFreeBusyOperations = {
+    CalendarFreeBusyOperations_listCalendarFreeBusy: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const query = context.request.query;
+        const window = readWindow(query.from, query.to);
+        if (!window.ok)
+            return badRequest(window.error);
+        const deps = calendarDepsOf(ctx.client);
+        const collections = await listCalendarsFor(deps, accountConfigId);
+        const spans = await listBusySpans(deps, collections, window.value);
+        const items = spans.map((span) => ({
+            start: toOffsetIso(span.startMs, "UTC"),
+            end: toOffsetIso(span.endMs, "UTC"),
+        }));
+        return { items };
+    },
+};

package/dist/src/handlers/calendar-feed.d.ts

@@ -0,0 +1,47 @@
+import type { CalendarFeedResponse, CalendarFeedStateResponse } from "@remit/api-openapi-types";
+import { type RawApiResponse } from "../response.js";
+import type { CalendarDetailOperationIds, CalendarFeedDetailOperationIds, OperationHandler, PublicOperationHandler } from "../types.js";
+import { type CalendarDeps, type CalendarOutcome } from "./calendar.js";
+/**
+ * Mints the calendar's feed address, or replaces the one it has.
+ *
+ * The plaintext exists here and nowhere else: the store keeps a digest, so this
+ * return value is the only chance anybody has to read the token. Ownership is
+ * settled before the mint — a calendar the caller does not hold is absent, not
+ * forbidden, which is the same answer `getCalendar` gives it.
+ */
+export declare const putCalendarFeedFor: (deps: CalendarDeps, accountConfigId: string, calendarId: string) => Promise<CalendarOutcome<CalendarFeedResponse>>;
+/** Whether the calendar has a feed address, and how old it is. */
+export declare const findCalendarFeedFor: (deps: CalendarDeps, accountConfigId: string, calendarId: string) => Promise<CalendarOutcome<CalendarFeedStateResponse>>;
+/**
+ * Revokes the calendar's feed address.
+ *
+ * A calendar with no feed is refused rather than answered 204: the caller asked
+ * for a subscription to stop working, and reporting success for one that was
+ * never there reads as confirmation that it has.
+ */
+export declare const revokeCalendarFeedFor: (deps: CalendarDeps, accountConfigId: string, calendarId: string) => Promise<CalendarOutcome<null>>;
+/**
+ * Serves a calendar to whoever holds its secret address.
+ *
+ * The token is the whole credential, so a value that cannot be one is refused
+ * before anything is hashed, and the digest of what arrived is what the store is
+ * asked about — the plaintext is never compared against a stored one because
+ * none is stored.
+ *
+ * `Last-Modified` is the collection's own timestamp, not the newest event in
+ * it: an event deleted from a calendar leaves every survivor older than the
+ * change, and a validator that moves backwards tells a subscriber its cached
+ * copy is still good. The collection is stamped by the same sequence bump every
+ * write and every delete goes through, so it only ever moves forward.
+ *
+ * A row whose collection is gone is the same 404. It should not exist — a
+ * calendar's delete takes its token with it, in one batch — and serving a
+ * blank calendar for one would be worse than saying nothing.
+ */
+export declare const serveCalendarFeed: (deps: CalendarDeps, feedToken: string, conditions: {
+    ifNoneMatch: string | undefined;
+    ifModifiedSince: string | undefined;
+}) => Promise<RawApiResponse>;
+export declare const CalendarFeedDetailOperations: Record<CalendarFeedDetailOperationIds, OperationHandler<CalendarDetailOperationIds>>;
+export declare const getCalendarFeedIcal: PublicOperationHandler;

package/dist/src/handlers/calendar-feed.js

@@ -0,0 +1,184 @@
+import { buildCalendarFeed, calendarFeedIsUnchanged, calendarFeedIsUnmodifiedSince, hashCalendarFeedToken, isCalendarFeedToken, mintCalendarFeedToken, readCalendarFeedToken, } from "@remit/calendar-service";
+import { NotFoundError } from "@remit/data-ports/errors";
+import { rawApiResponse } from "../response.js";
+import { calendarDepsOf, findCalendarFor, notFound, refuseCalendar, } from "./calendar.js";
+const toFeedState = (token) => ({
+    calendarId: token.calendarId,
+    createdAt: token.createdAt,
+    rotatedAt: token.rotatedAt,
+});
+/**
+ * Mints the calendar's feed address, or replaces the one it has.
+ *
+ * The plaintext exists here and nowhere else: the store keeps a digest, so this
+ * return value is the only chance anybody has to read the token. Ownership is
+ * settled before the mint — a calendar the caller does not hold is absent, not
+ * forbidden, which is the same answer `getCalendar` gives it.
+ */
+export const putCalendarFeedFor = async (deps, accountConfigId, calendarId) => {
+    const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+    if (!calendar.ok)
+        return calendar;
+    const secret = mintCalendarFeedToken();
+    const stored = await deps.calendarFeedToken.put({
+        accountConfigId,
+        calendarId,
+        tokenHash: secret.tokenHash,
+    });
+    return {
+        ok: true,
+        value: {
+            calendarId: stored.calendarId,
+            feedToken: secret.token,
+            createdAt: stored.createdAt,
+            rotatedAt: stored.rotatedAt,
+        },
+    };
+};
+/** Whether the calendar has a feed address, and how old it is. */
+export const findCalendarFeedFor = async (deps, accountConfigId, calendarId) => {
+    const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+    if (!calendar.ok)
+        return calendar;
+    const stored = await deps.calendarFeedToken.findByCalendar(accountConfigId, calendarId);
+    if (!stored) {
+        return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+    }
+    return { ok: true, value: toFeedState(stored) };
+};
+/**
+ * Revokes the calendar's feed address.
+ *
+ * A calendar with no feed is refused rather than answered 204: the caller asked
+ * for a subscription to stop working, and reporting success for one that was
+ * never there reads as confirmation that it has.
+ */
+export const revokeCalendarFeedFor = async (deps, accountConfigId, calendarId) => {
+    const calendar = await findCalendarFor(deps, accountConfigId, calendarId);
+    if (!calendar.ok)
+        return calendar;
+    const stored = await deps.calendarFeedToken.findByCalendar(accountConfigId, calendarId);
+    if (!stored) {
+        return refuseCalendar("NotFound", `no feed on calendar ${calendarId}`);
+    }
+    await deps.calendarFeedToken.delete(accountConfigId, calendarId);
+    return { ok: true, value: null };
+};
+/**
+ * No feed answers to this address.
+ *
+ * One answer for an unknown token, a revoked one and a malformed one, with a
+ * body that says the same thing to all three: a caller probing addresses learns
+ * only whether the one it sent works, which is what it was going to find out
+ * anyway.
+ */
+const feedNotFound = () => rawApiResponse({
+    statusCode: 404,
+    headers: { "Content-Type": "text/plain; charset=utf-8" },
+    body: "no calendar feed at this address\n",
+});
+/**
+ * Serves a calendar to whoever holds its secret address.
+ *
+ * The token is the whole credential, so a value that cannot be one is refused
+ * before anything is hashed, and the digest of what arrived is what the store is
+ * asked about — the plaintext is never compared against a stored one because
+ * none is stored.
+ *
+ * `Last-Modified` is the collection's own timestamp, not the newest event in
+ * it: an event deleted from a calendar leaves every survivor older than the
+ * change, and a validator that moves backwards tells a subscriber its cached
+ * copy is still good. The collection is stamped by the same sequence bump every
+ * write and every delete goes through, so it only ever moves forward.
+ *
+ * A row whose collection is gone is the same 404. It should not exist — a
+ * calendar's delete takes its token with it, in one batch — and serving a
+ * blank calendar for one would be worse than saying nothing.
+ */
+export const serveCalendarFeed = async (deps, feedToken, conditions) => {
+    if (!isCalendarFeedToken(feedToken))
+        return feedNotFound();
+    const stored = await deps.calendarFeedToken.findByTokenHash(hashCalendarFeedToken(feedToken));
+    if (!stored)
+        return feedNotFound();
+    const collection = await deps.calendarCollection
+        .get(stored.accountConfigId, stored.calendarId)
+        .catch((error) => {
+        if (error instanceof NotFoundError)
+            return null;
+        throw error;
+    });
+    if (!collection)
+        return feedNotFound();
+    const objects = await deps.calendarObject.listByCalendar(stored.calendarId);
+    const feed = buildCalendarFeed(collection, objects);
+    const etag = `"${feed.etag}"`;
+    const lastModified = new Date(collection.updatedAt).toUTCString();
+    // `If-None-Match` wins outright when both arrive (RFC 9110 13.2.2): the tag
+    // is exact where the date is truncated to the second, so honouring the date
+    // as well could only turn a 200 the tag asked for into a 304.
+    const unchanged = conditions.ifNoneMatch === undefined
+        ? calendarFeedIsUnmodifiedSince(conditions.ifModifiedSince, collection.updatedAt)
+        : calendarFeedIsUnchanged(conditions.ifNoneMatch, feed.etag);
+    if (unchanged) {
+        return rawApiResponse({
+            statusCode: 304,
+            headers: { ETag: etag, "Last-Modified": lastModified },
+            body: "",
+        });
+    }
+    return rawApiResponse({
+        statusCode: 200,
+        headers: {
+            "Content-Type": "text/calendar; charset=utf-8",
+            ETag: etag,
+            "Last-Modified": lastModified,
+        },
+        body: feed.icalData,
+    });
+};
+export const CalendarFeedDetailOperations = {
+    CalendarDetailOperations_getCalendarFeed: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const { calendarId } = context.request.params;
+        const deps = calendarDepsOf(ctx.client);
+        const found = await findCalendarFeedFor(deps, accountConfigId, calendarId);
+        if (!found.ok)
+            return notFound(found.error.message);
+        return found.value;
+    },
+    CalendarDetailOperations_putCalendarFeed: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const { calendarId } = context.request.params;
+        const deps = calendarDepsOf(ctx.client);
+        const minted = await putCalendarFeedFor(deps, accountConfigId, calendarId);
+        if (!minted.ok)
+            return notFound(minted.error.message);
+        return minted.value;
+    },
+    CalendarDetailOperations_revokeCalendarFeed: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const { calendarId } = context.request.params;
+        const deps = calendarDepsOf(ctx.client);
+        const revoked = await revokeCalendarFeedFor(deps, accountConfigId, calendarId);
+        if (!revoked.ok)
+            return notFound(revoked.error.message);
+        return { statusCode: 204 };
+    },
+};
+export const getCalendarFeedIcal = async (context, ctx) => {
+    // From the raw path, not from the router's captured parameter: the matcher
+    // substitutes the parameter into the literal path and leaves the dot of
+    // ".ics" as a regex dot, so /feeds/calendar/<token>Xics routes here too —
+    // and answering it would serve the feed at an address nobody was handed.
+    const feedToken = readCalendarFeedToken(context.request.path);
+    if (feedToken === null)
+        return feedNotFound();
+    const ifNoneMatch = context.request.headers["if-none-match"];
+    const ifModifiedSince = context.request.headers["if-modified-since"];
+    const deps = calendarDepsOf(ctx.client);
+    return serveCalendarFeed(deps, feedToken, {
+        ifNoneMatch: typeof ifNoneMatch === "string" ? ifNoneMatch : undefined,
+        ifModifiedSince: typeof ifModifiedSince === "string" ? ifModifiedSince : undefined,
+    });
+};