@sockethub/platform-caldav 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/index.js

@@ -66075,9 +66075,10 @@ function xmlText(value) {
     return predefined[entity.toLowerCase()] ?? reference;
   });
 }
-function parseDavXml(xml) {
+function parseDavXml(xml, options = {}) {
   return new XMLParser({
     ignoreAttributes: false,
+    parseTagValue: options.parseTagValue ?? true,
     removeNSPrefix: true,
     processEntities: false,
     tagValueProcessor: (_tagName, value) => xmlText(value),
@@ -66106,6 +66107,39 @@ function propertyHref(value) {
     return davHref(value.href);
   return davHref(value);
 }
+function safePathname(pathname) {
+  if (pathname.includes("\\") || /%(?:2f|5c)/i.test(pathname))
+    return false;
+  for (const segment of pathname.split("/")) {
+    let decoded = segment;
+    try {
+      for (let pass = 0;pass < 3; pass += 1) {
+        const next = decodeURIComponent(decoded);
+        if (next === decoded)
+          break;
+        decoded = next;
+      }
+    } catch {
+      return false;
+    }
+    if (decoded === "." || decoded === ".." || /[\\/]/.test(decoded))
+      return false;
+  }
+  return true;
+}
+function isDavCollectionChild(collectionId, resourceId) {
+  try {
+    const collection = new URL(collectionId);
+    const resource = new URL(resourceId);
+    if (collection.search || collection.hash || resource.search || resource.hash || !safePathname(collection.pathname) || !safePathname(resource.pathname))
+      return false;
+    const prefix = collection.pathname.endsWith("/") ? collection.pathname : `${collection.pathname}/`;
+    return resource.origin === collection.origin && resource.pathname.startsWith(prefix) && resource.pathname !== prefix;
+  } catch {
+    return false;
+  }
+}
+
 class DiscoveryCache {
   maxEntries;
   secret = randomBytes(32);
@@ -66223,6 +66257,16 @@ function digestChallenge(header) {
   return;
 }
 var quote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+var isStatus = (value, code) => new RegExp(`\\s${code}(?:\\s|$)`).test(String(value ?? ""));
+function davPreconditions(xml) {
+  try {
+    const error = parseDavXml(xml).error;
+    return error && typeof error === "object" ? Object.keys(error) : [];
+  } catch {
+    return [];
+  }
+}
+var xmlEscape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 
 class DavClient {
   authentication;
@@ -66267,9 +66311,10 @@ class DavClient {
     this.assertAllowed(url);
     let response;
     try {
+      const { passForbidden: _, ...fetchInit } = init;
       const authorization = this.authorization(url, init);
       response = await this.fetchImpl(url, {
-        ...init,
+        ...fetchInit,
         redirect: "manual",
         signal,
         headers: {
@@ -66313,7 +66358,7 @@ class DavClient {
       }
       throw new DavFailure(`${this.errorPrefix}:${authAttempts > 0 ? "authentication-failed" : "unsupported-authentication"}`);
     }
-    if (response.status === 401 || response.status === 403) {
+    if (response.status === 401 || response.status === 403 && !init.passForbidden) {
       await response.body?.cancel().catch(() => {});
       throw new DavFailure(`${this.errorPrefix}:authentication-failed`);
     }
@@ -66334,6 +66379,146 @@ class DavClient {
       await response.body?.cancel().catch(() => {});
       throw new DavFailure(`${this.errorPrefix}:invalid-response`);
     }
+    return this.readMultistatus(response);
+  }
+  async syncCollection(collection, prop, syncToken, namespaces = "") {
+    const response = await this.request(collection, {
+      method: "REPORT",
+      passForbidden: true,
+      headers: {
+        depth: "0",
+        "content-type": "application/xml; charset=utf-8"
+      },
+      body: `<?xml version="1.0" encoding="utf-8"?>
+<d:sync-collection xmlns:d="DAV:"${namespaces ? ` ${namespaces}` : ""}>
+ ${syncToken ? `<d:sync-token>${xmlEscape(syncToken)}</d:sync-token>` : "<d:sync-token/>"}
+ <d:sync-level>1</d:sync-level>
+ <d:prop>${prop}</d:prop>
+</d:sync-collection>`
+    });
+    if (response.status !== 207) {
+      let body = "";
+      try {
+        body = await response.text();
+      } catch {}
+      const preconditions = davPreconditions(body);
+      const prefix = this.errorPrefix;
+      if (preconditions.includes("valid-sync-token"))
+        throw new DavFailure(`${prefix}:sync-token-invalid`);
+      if (preconditions.includes("supported-report"))
+        throw new DavFailure(`${prefix}:sync-unsupported`);
+      if (response.status === 404)
+        throw new DavFailure(`${prefix}:not-found`);
+      if ([400, 409, 412].includes(response.status) && syncToken)
+        throw new DavFailure(`${prefix}:sync-token-invalid`);
+      if (response.status === 403)
+        throw new DavFailure(`${prefix}:authentication-failed`);
+      if ([400, 405, 415, 501].includes(response.status))
+        throw new DavFailure(`${prefix}:sync-unsupported`);
+      throw new DavFailure(`${prefix}:sync-failed`);
+    }
+    let multistatus;
+    try {
+      const parsed = parseDavXml(await response.text(), {
+        parseTagValue: false
+      }).multistatus;
+      if (!parsed || typeof parsed !== "object")
+        throw new Error;
+      multistatus = parsed;
+    } catch {
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    const token = multistatus["sync-token"];
+    if (typeof token !== "string" || token.trim() === "")
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    const result = {
+      changed: [],
+      removed: [],
+      syncToken: token.trim(),
+      truncated: false
+    };
+    for (const item of asArray(multistatus.response)) {
+      const href = davHref(item.href);
+      if (!href)
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+      const id = new URL(href, collection).href;
+      const status = item.status;
+      if (id === collection.href || `${id}/` === collection.href) {
+        if (isStatus(status, 507))
+          result.truncated = true;
+        continue;
+      }
+      if (!isDavCollectionChild(collection.href, id))
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+      if (isStatus(status, 404))
+        result.removed.push(id);
+      else
+        result.changed.push({ id, props: successfulProps(item) });
+    }
+    return result;
+  }
+  async syncResources(collection, options, syncToken) {
+    const property = options.data.slice(options.data.indexOf(":") + 1);
+    const sync = await this.syncCollection(collection, `<d:getetag/><${options.data}/>`, syncToken, options.namespaces);
+    const resources = [];
+    const missing = new Map;
+    const add = (id, value, etag) => {
+      const data = value && typeof value === "object" ? value["#text"] : value;
+      if (typeof data !== "string")
+        return false;
+      resources.push({
+        id,
+        data,
+        ...typeof etag === "string" ? { etag } : {}
+      });
+      return true;
+    };
+    for (const member of sync.changed)
+      if (!add(member.id, member.props[property], member.props.getetag))
+        missing.set(member.id, member.props.getetag);
+    if (missing.size) {
+      const hrefs = [...missing.keys()].map((id) => `<d:href>${xmlEscape(new URL(id).pathname)}</d:href>`).join("");
+      const response = await this.request(collection, {
+        method: "REPORT",
+        headers: {
+          depth: "1",
+          "content-type": "application/xml; charset=utf-8"
+        },
+        body: `<?xml version="1.0" encoding="utf-8"?>
+<${options.multiget} xmlns:d="DAV:" ${options.namespaces}>
+ <d:prop><d:getetag/><${options.data}/></d:prop>
+ ${hrefs}
+</${options.multiget}>`
+      });
+      if (response.status !== 207)
+        return rejectDavResponse(response, `${this.errorPrefix}:sync-failed`);
+      for (const item of await this.readMultistatus(response)) {
+        const href = davHref(item.href);
+        if (!href)
+          continue;
+        const id = new URL(href, collection).href;
+        if (!missing.has(id))
+          continue;
+        if (isStatus(item.status, 404)) {
+          sync.removed.push(id);
+          missing.delete(id);
+          continue;
+        }
+        const props = successfulProps(item);
+        if (add(id, props[property], props.getetag ?? missing.get(id)))
+          missing.delete(id);
+      }
+      if (missing.size)
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    return {
+      resources,
+      removed: sync.removed,
+      syncToken: sync.syncToken,
+      truncated: sync.truncated
+    };
+  }
+  async readMultistatus(response) {
     try {
       const parsed = parseDavXml(await response.text());
       return asArray(parsed.multistatus?.response);
@@ -66634,7 +66819,7 @@ var ActivityStreamSchema = {
 var package_default = {
   name: "@sockethub/schemas",
   description: "JSON schema files for validating Sockethub Activity Streams",
-  version: "3.0.0-beta.3",
+  version: "3.0.0-beta.5",
   type: "module",
   private: false,
   author: "Nick Jennings <nick@silverbucket.net>",
@@ -66704,7 +66889,7 @@ var package_default = {
     "ajv-formats": "^2.1.1",
     "ajv-formats-draft2019": "^1.6.1"
   },
-  gitHead: "bc04522d60d1e2fa1b3098b339897de62c3b0549",
+  gitHead: "cc4ffdd9714ebbd8372a88c4f2d795974e04029e",
   types: "./dist/index.d.ts"
 };
 
@@ -68124,7 +68309,15 @@ var queryBody = (query) => `<?xml version="1.0" encoding="utf-8"?>
  <d:prop><d:getetag/><c:calendar-data/></d:prop>
  <c:filter><c:comp-filter name="VCALENDAR"><c:comp-filter name="${query.type === "task" ? "VTODO" : "VEVENT"}">${query.startTime || query.endTime ? `<c:time-range${query.startTime ? ` start="${calDavTime(query.startTime)}"` : ""}${query.endTime ? ` end="${calDavTime(query.endTime)}"` : ""}/>` : ""}</c:comp-filter></c:comp-filter></c:filter>
 </c:calendar-query>`;
+var HAS_EVENT_OR_TASK = /^BEGIN:(?:VEVENT|VTODO)\r?$/m;
 var CalDavFailure = DavFailure;
+function calendarItem(data, id, etag) {
+  try {
+    return parseICalendar(data, id, typeof etag === "string" ? etag : undefined);
+  } catch {
+    throw new CalDavFailure("caldav:invalid-response");
+  }
+}
 
 class CalDavClient extends DavClient {
   constructor(url, authentication, timeoutMs = 15000, networkOptions = {}) {
@@ -68232,28 +68425,28 @@ class CalDavClient extends DavClient {
         await response.body?.cancel().catch(() => {});
         throw new CalDavFailure("caldav:query-failed");
       }
-      let parsed;
-      try {
-        parsed = parseDavXml(await response.text());
-      } catch {
-        throw new CalDavFailure("caldav:invalid-response");
-      }
-      const responses = asArray(parsed.multistatus?.response);
-      for (const item of responses) {
+      for (const item of await this.readMultistatus(response)) {
         const props = successfulProps(item);
         const itemHref = davHref(item.href);
         const data = props["calendar-data"];
         if (!itemHref || typeof data !== "string")
           continue;
-        try {
-          items.push(parseICalendar(data, new URL(itemHref, calendar.id).href, typeof props.getetag === "string" ? props.getetag : undefined));
-        } catch {
-          throw new CalDavFailure("caldav:invalid-response");
-        }
+        items.push(calendarItem(data, new URL(itemHref, calendar.id).href, props.getetag));
       }
     }
     return items;
   }
+  async sync(calendar, syncToken) {
+    const { resources, ...result } = await this.syncResources(new URL(calendar.id), {
+      namespaces: 'xmlns:c="urn:ietf:params:xml:ns:caldav"',
+      data: "c:calendar-data",
+      multiget: "c:calendar-multiget"
+    }, syncToken);
+    return {
+      ...result,
+      items: resources.filter((resource) => HAS_EVENT_OR_TASK.test(resource.data)).map((resource) => calendarItem(resource.data, resource.id, resource.etag))
+    };
+  }
   async update(id, etag, body) {
     const resource = new URL(id);
     this.assertAllowed(resource);
@@ -68489,7 +68682,7 @@ END:VCALENDAR\r
 var package_default2 = {
   name: "@sockethub/platform-caldav",
   description: "A Sockethub platform for synchronizing CalDAV calendars, events, and tasks",
-  version: "1.0.0-beta.3",
+  version: "1.0.0-beta.5",
   type: "module",
   private: false,
   license: "LGPL-3.0+",
@@ -68523,16 +68716,16 @@ var package_default2 = {
     test: "bun test src/"
   },
   dependencies: {
-    "@sockethub/dav": "^1.0.0-beta.3",
-    "@sockethub/schemas": "^3.0.0-beta.3",
-    "@sockethub/util": "^1.0.0-beta.3",
+    "@sockethub/dav": "^1.0.0-beta.5",
+    "@sockethub/schemas": "^3.0.0-beta.5",
+    "@sockethub/util": "^1.0.0-beta.5",
     undici: "^7.30.0"
   },
   devDependencies: {
     "@types/bun": "latest"
   },
   peerDependencies: {
-    "@sockethub/server": "^5.0.0-beta.3"
+    "@sockethub/server": "^5.0.0-beta.5"
   },
   peerDependenciesMeta: {
     "@sockethub/server": {
@@ -68540,7 +68733,7 @@ var package_default2 = {
     }
   },
   types: "./dist/index.d.ts",
-  gitHead: "bc04522d60d1e2fa1b3098b339897de62c3b0549"
+  gitHead: "cc4ffdd9714ebbd8372a88c4f2d795974e04029e"
 };
 
 // src/schema.ts
@@ -68737,7 +68930,13 @@ var queryObject = {
     endTime: { type: "string", format: "date-time" }
   }
 };
-var calendarItem = { oneOf: [eventObject, taskObject] };
+var syncToken = { type: "string", minLength: 1, maxLength: 4096 };
+var syncObject = {
+  type: "object",
+  additionalProperties: false,
+  properties: { syncToken }
+};
+var calendarItem2 = { oneOf: [eventObject, taskObject] };
 var mutationObject = {
   type: "object",
   required: ["id", "type"],
@@ -68760,12 +68959,26 @@ var PlatformCalDavSchema = {
     properties: {
       type: {
         type: "string",
-        enum: ["fetch", "read", "query", "create", "update", "delete"]
+        enum: [
+          "fetch",
+          "read",
+          "query",
+          "sync",
+          "create",
+          "update",
+          "delete"
+        ]
       },
       actor,
       target: { oneOf: [target, feedTarget] },
       object: {
-        oneOf: [eventObject, taskObject, deleteObject, queryObject]
+        oneOf: [
+          eventObject,
+          taskObject,
+          deleteObject,
+          queryObject,
+          { ...syncObject, required: ["syncToken"] }
+        ]
       }
     }
   },
@@ -68794,11 +69007,19 @@ var PlatformCalDavSchema = {
         },
         required: ["type", "actor", "target"]
       },
+      {
+        properties: {
+          type: { const: "sync" },
+          target,
+          object: syncObject
+        },
+        required: ["type", "actor", "target"]
+      },
       {
         properties: {
           type: { const: "create" },
           target,
-          object: calendarItem
+          object: calendarItem2
         },
         required: ["type", "actor", "target", "object"]
       },
@@ -68909,7 +69130,7 @@ var PlatformCalDavSchema = {
             type: "array",
             items: {
               oneOf: [
-                calendarItem,
+                calendarItem2,
                 {
                   type: "object",
                   required: [
@@ -68939,6 +69160,30 @@ var PlatformCalDavSchema = {
           }
         }
       },
+      {
+        type: "object",
+        required: [
+          "@context",
+          "type",
+          "totalItems",
+          "items",
+          "removed",
+          "syncToken",
+          "truncated"
+        ],
+        additionalProperties: false,
+        properties: {
+          "@context": { type: "array", items: { type: "string" } },
+          id: { type: ["string", "null"] },
+          type: { const: "collection" },
+          summary: { type: "string" },
+          totalItems: { type: "integer", minimum: 0 },
+          items: { type: "array", items: calendarItem2 },
+          removed: { type: "array", items: shared.id },
+          syncToken,
+          truncated: { type: "boolean" }
+        }
+      },
       {
         type: "object",
         required: ["@context", "type", "actor", "target", "object"],
@@ -68960,39 +69205,8 @@ var PlatformCalDavSchema = {
 var CONTEXT = buildCanonicalContext(PlatformCalDavSchema.contextUrl);
 var MAX_FEED_BYTES = 10 * 1024 * 1024;
 var MAX_FEED_REDIRECTS = 5;
-function safePathname(pathname) {
-  if (pathname.includes("\\") || /%(?:2f|5c)/i.test(pathname))
-    return false;
-  for (const segment of pathname.split("/")) {
-    let decoded = segment;
-    try {
-      for (let pass = 0;pass < 3; pass += 1) {
-        const next = decodeURIComponent(decoded);
-        if (next === decoded)
-          break;
-        decoded = next;
-      }
-    } catch {
-      return false;
-    }
-    if (decoded === "." || decoded === ".." || /[\\/]/.test(decoded))
-      return false;
-  }
-  return true;
-}
 function assertCalendarResource(calendarId, resourceId) {
-  let calendar;
-  let resource;
-  try {
-    calendar = new URL(calendarId);
-    resource = new URL(resourceId);
-  } catch {
-    throw new CalDavFailure("caldav:invalid-resource");
-  }
-  if (calendar.search || calendar.hash || resource.search || resource.hash || !safePathname(calendar.pathname) || !safePathname(resource.pathname))
-    throw new CalDavFailure("caldav:invalid-resource");
-  const prefix = calendar.pathname.endsWith("/") ? calendar.pathname : `${calendar.pathname}/`;
-  if (resource.origin !== calendar.origin || !resource.pathname.startsWith(prefix) || resource.pathname === prefix)
+  if (!isDavCollectionChild(calendarId, resourceId))
     throw new CalDavFailure("caldav:invalid-resource");
 }
 
@@ -69003,7 +69217,14 @@ class CalDav {
   discovery = new DiscoveryCache;
   config = {
     persist: false,
-    requireCredentials: ["fetch", "query", "create", "update", "delete"],
+    requireCredentials: [
+      "fetch",
+      "query",
+      "sync",
+      "create",
+      "update",
+      "delete"
+    ],
     connectTimeoutMs: 15000,
     allowPrivateAddresses: false,
     allowInsecureHttp: false,
@@ -69093,6 +69314,18 @@ class CalDav {
       items
     })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
+  sync(job, credentials, done) {
+    const client = this.client(credentials);
+    const input = job.object ?? {};
+    this.calendar(client, credentials, job.target?.id ?? "").then((calendar) => client.sync(calendar, input.syncToken)).then((result) => done(null, {
+      "@context": CONTEXT,
+      ...job.id ? { id: job.id } : {},
+      type: "collection",
+      summary: "CalDAV changes",
+      totalItems: result.items.length,
+      ...result
+    })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
+  }
   update(job, credentials, done) {
     const client = this.client(credentials);
     const input = job.object;
@@ -69228,4 +69461,4 @@ export {
   foldLine
 };
 
-//# debugId=DEF47195F0892FA064756E2164756E21
+//# debugId=16184EE35BE0342464756E2164756E21