caldav-adapter 9.0.0 → 9.2.0

package/common/response.js

@@ -11,8 +11,11 @@ const setDAVHeader = function (ctx) {
       '3',
       // 'extended-mkcol',
       'calendar-access',
-      'calendar-schedule'
-      // 'calendar-auto-schedule',
+      'calendar-schedule',
+      'calendar-auto-schedule',
+      /* https://www.rfc-editor.org/rfc/rfc8607.html */
+      'calendar-managed-attachments',
+      'calendar-managed-attachments-no-recurrence'
       /* https://github.com/apple/ccs-calendarserver/blob/master/doc/Extensions/caldav-proxy.txt */
       // 'calendar-proxy',
       // 'calendarserver-sharing',

package/common/tags.js

@@ -340,7 +340,15 @@ module.exports = function (options) {
       },
       'schedule-inbox-URL': {
         doc: 'https://tools.ietf.org/html/rfc6638#section-2.2',
-        async resp() {
+        async resp({ ctx }) {
+          if (ctx && ctx.state && ctx.state.calendarHomeUrl) {
+            return {
+              [buildTag(cal, 'schedule-inbox-URL')]: href(
+                ctx.state.calendarHomeUrl.replace(/\/$/, '') + '/inbox/'
+              )
+            };
+          }
+
           return {
             [buildTag(cal, 'schedule-inbox-URL')]: href('')
           };
@@ -348,7 +356,15 @@ module.exports = function (options) {
       },
       'schedule-outbox-URL': {
         doc: 'https://tools.ietf.org/html/rfc6638#section-2.1',
-        async resp() {
+        async resp({ ctx }) {
+          if (ctx && ctx.state && ctx.state.calendarHomeUrl) {
+            return {
+              [buildTag(cal, 'schedule-outbox-URL')]: href(
+                ctx.state.calendarHomeUrl.replace(/\/$/, '') + '/outbox/'
+              )
+            };
+          }
+
           return {
             [buildTag(cal, 'schedule-outbox-URL')]: href('')
           };
@@ -368,6 +384,77 @@ module.exports = function (options) {
             };
           }
         }
+      },
+      'schedule-default-calendar-URL': {
+        doc: 'https://tools.ietf.org/html/rfc6638#section-9.2',
+        async resp({ ctx }) {
+          if (ctx && ctx.state && ctx.state.calendarUrl) {
+            return {
+              [buildTag(cal, 'schedule-default-calendar-URL')]: href(
+                ctx.state.calendarUrl
+              )
+            };
+          }
+
+          return {
+            [buildTag(cal, 'schedule-default-calendar-URL')]: href('')
+          };
+        }
+      },
+      'schedule-calendar-transp': {
+        doc: 'https://tools.ietf.org/html/rfc6638#section-9.1',
+        async resp({ resource, calendar }) {
+          if (resource === 'calendar') {
+            // Default to opaque (events affect free-busy)
+            const transp = calendar?.scheduleTransp || 'opaque';
+            return {
+              [buildTag(cal, 'schedule-calendar-transp')]: {
+                [buildTag(cal, transp)]: ''
+              }
+            };
+          }
+        }
+      },
+      'schedule-tag': {
+        doc: 'https://tools.ietf.org/html/rfc6638#section-3.2.10',
+        async resp({ resource, event }) {
+          if (resource === 'event' && event?.scheduleTag) {
+            return {
+              [buildTag(cal, 'schedule-tag')]: event.scheduleTag
+            };
+          }
+        }
+      },
+      /* RFC 8607 Managed Attachments */
+      'max-attachment-size': {
+        doc: 'https://www.rfc-editor.org/rfc/rfc8607.html#section-5.1',
+        async resp({ resource }) {
+          if (resource === 'calendar') {
+            return {
+              [buildTag(cal, 'max-attachment-size')]: '10485760'
+            };
+          }
+        }
+      },
+      'max-attachments-per-resource': {
+        doc: 'https://www.rfc-editor.org/rfc/rfc8607.html#section-5.2',
+        async resp({ resource }) {
+          if (resource === 'calendar') {
+            return {
+              [buildTag(cal, 'max-attachments-per-resource')]: '10'
+            };
+          }
+        }
+      },
+      'managed-attachments-server-URL': {
+        doc: 'https://www.rfc-editor.org/rfc/rfc8607.html#section-5.3',
+        async resp({ resource }) {
+          if (resource === 'calendar') {
+            return {
+              [buildTag(cal, 'managed-attachments-server-URL')]: ''
+            };
+          }
+        }
       }
     },
     [cs]: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "caldav-adapter",
   "description": "CalDAV server for Node.js and Koa. Modernized and maintained for Forward Email.",
-  "version": "9.0.0",
+  "version": "9.2.0",
   "author": "Sanders DeNardi and Forward Email LLC",
   "contributors": [
     "Sanders DeNardi <sedenardi@gmail.com> (http://www.sandersdenardi.com/)",

package/routes/calendar/calendar.js

@@ -14,6 +14,7 @@ const routerCalGet = require('./calendar/get');
 const routerCalProppatch = require('./calendar/proppatch');
 const routerCalPut = require('./calendar/put');
 const routerCalDelete = require('./calendar/delete');
+const routerScheduling = require('./scheduling');
 
 module.exports = function (options) {
   const log = winston({ ...options, label: 'calendar' });
@@ -31,10 +32,21 @@ module.exports = function (options) {
     mkcalendar: routeMkCalendar(options)
   };
 
+  // Initialize scheduling routes
+  const scheduling = routerScheduling(options);
+
   return async function (ctx) {
     const method = ctx.method.toLowerCase();
     const { calendarId } = ctx.state.params;
 
+    // Check for scheduling inbox/outbox routes
+    // These are special endpoints at /cal/:principalId/inbox/ and /cal/:principalId/outbox/
+    const urlLower = ctx.url.toLowerCase();
+    if (urlLower.includes('/inbox') || urlLower.includes('/outbox')) {
+      log.debug('Routing to scheduling handler', { url: ctx.url, method });
+      return scheduling.route(ctx);
+    }
+
     if (calendarId) {
       // Check calendar exists & user has access
       const calendar = await options.data.getCalendar(ctx, {

package/routes/calendar/scheduling.js

@@ -0,0 +1,370 @@
+/**
+ * RFC 6638 Scheduling Extensions to CalDAV
+ * Scheduling inbox/outbox routes handler
+ *
+ * @see https://tools.ietf.org/html/rfc6638
+ */
+
+const {
+  build,
+  buildTag,
+  href,
+  multistatus,
+  response,
+  status
+} = require('../../common/x-build');
+const { setMultistatusResponse, setOptions } = require('../../common/response');
+const winston = require('../../common/winston');
+
+const dav = 'DAV:';
+const cal = 'urn:ietf:params:xml:ns:caldav';
+
+module.exports = function (options) {
+  const log = winston({ ...options, label: 'scheduling' });
+
+  /**
+   * Handle POST to scheduling outbox for iTIP and free-busy queries
+   * POST /cal/:principalId/outbox/
+   *
+   * @see https://tools.ietf.org/html/rfc6638#section-3.2
+   */
+  async function postOutbox(ctx) {
+    log.debug('POST outbox request', { url: ctx.url });
+
+    const { body } = ctx.request;
+    if (!body) {
+      ctx.status = 400;
+      ctx.body = 'Missing request body';
+      return;
+    }
+
+    // Check if this is a free-busy query
+    if (body.includes('VFREEBUSY') && body.includes('METHOD:REQUEST')) {
+      return handleFreeBusyQuery(ctx, body);
+    }
+
+    // Handle iTIP scheduling request
+    return handleItipRequest(ctx, body);
+  }
+
+  /**
+   * Get free-busy data for a single attendee
+   */
+  async function getFreeBusyForAttendee(ctx, attendee) {
+    let scheduleStatus = '2.0'; // Success
+    let freeBusyData = '';
+
+    try {
+      freeBusyData =
+        typeof options.data.getFreeBusy === 'function'
+          ? await options.data.getFreeBusy(ctx, attendee)
+          : generateEmptyFreeBusy(attendee);
+    } catch (err) {
+      log.warn('Error getting free-busy data', {
+        attendee,
+        error: err.message
+      });
+      scheduleStatus = '3.7'; // Invalid calendar user
+    }
+
+    return {
+      [buildTag(cal, 'response')]: {
+        [buildTag(cal, 'recipient')]: href(`mailto:${attendee}`),
+        [buildTag(cal, 'request-status')]: scheduleStatus,
+        [buildTag(cal, 'calendar-data')]: freeBusyData
+      }
+    };
+  }
+
+  /**
+   * Handle free-busy query
+   * @see https://tools.ietf.org/html/rfc6638#section-3.2.1
+   */
+  async function handleFreeBusyQuery(ctx, body) {
+    log.debug('Processing free-busy query');
+
+    // Extract attendees from the request
+    const attendeeMatches =
+      body.match(/attendee[^:]*:mailto:([^\r\n]+)/gi) || [];
+    const attendees = attendeeMatches
+      .map((match) => {
+        const email = match.match(/mailto:([^\r\n]+)/i);
+        return email ? email[1].toLowerCase() : null;
+      })
+      .filter(Boolean);
+
+    if (attendees.length === 0) {
+      ctx.status = 400;
+      ctx.body = 'No attendees specified in free-busy query';
+      return;
+    }
+
+    // Build schedule-response for each attendee (in parallel)
+    const responses = await Promise.all(
+      attendees.map((attendee) => getFreeBusyForAttendee(ctx, attendee))
+    );
+
+    setMultistatusResponse(ctx);
+    ctx.body = build(
+      multistatus([
+        {
+          [buildTag(cal, 'schedule-response')]: responses
+        }
+      ])
+    );
+  }
+
+  /**
+   * Send scheduling message to a single attendee
+   */
+  async function sendMessageToAttendee(ctx, method, attendee, icalData) {
+    let scheduleStatus = '1.1'; // Pending - message queued for delivery
+
+    try {
+      if (typeof options.data.sendSchedulingMessage === 'function') {
+        await options.data.sendSchedulingMessage(ctx, {
+          method,
+          attendee,
+          icalData
+        });
+        scheduleStatus = '1.2'; // Delivered
+      }
+    } catch (err) {
+      log.warn('Error sending scheduling message', {
+        attendee,
+        error: err.message
+      });
+      scheduleStatus = '5.1'; // Could not complete delivery
+    }
+
+    return {
+      [buildTag(cal, 'response')]: {
+        [buildTag(cal, 'recipient')]: href(`mailto:${attendee}`),
+        [buildTag(cal, 'request-status')]: scheduleStatus
+      }
+    };
+  }
+
+  /**
+   * Handle iTIP scheduling request (REQUEST, REPLY, CANCEL, etc.)
+   * @see https://tools.ietf.org/html/rfc6638#section-3.2.2
+   */
+  async function handleItipRequest(ctx, body) {
+    log.debug('Processing iTIP request');
+
+    // Extract METHOD from the iCalendar data
+    const methodMatch = body.match(/method:([a-z]+)/i);
+    const method = methodMatch ? methodMatch[1].toUpperCase() : 'REQUEST';
+
+    // Extract attendees
+    const attendeeMatches =
+      body.match(/attendee[^:]*:mailto:([^\r\n]+)/gi) || [];
+    const attendees = attendeeMatches
+      .map((match) => {
+        const email = match.match(/mailto:([^\r\n]+)/i);
+        return email ? email[1].toLowerCase() : null;
+      })
+      .filter(Boolean);
+
+    // Send messages in parallel
+    const responses = await Promise.all(
+      attendees.map((attendee) =>
+        sendMessageToAttendee(ctx, method, attendee, body)
+      )
+    );
+
+    setMultistatusResponse(ctx);
+    ctx.body = build(
+      multistatus([
+        {
+          [buildTag(cal, 'schedule-response')]: responses
+        }
+      ])
+    );
+  }
+
+  /**
+   * Handle PROPFIND on scheduling inbox
+   * PROPFIND /cal/:principalId/inbox/
+   *
+   * @see https://tools.ietf.org/html/rfc6638#section-2.2
+   */
+  async function propfindInbox(ctx) {
+    log.debug('PROPFIND inbox request', { url: ctx.url });
+
+    const props = [
+      {
+        [buildTag(dav, 'resourcetype')]: {
+          [buildTag(dav, 'collection')]: '',
+          [buildTag(cal, 'schedule-inbox')]: ''
+        }
+      },
+      { [buildTag(dav, 'displayname')]: 'Schedule Inbox' },
+      { [buildTag(cal, 'calendar-free-busy-set')]: '' },
+      {
+        [buildTag(dav, 'current-user-privilege-set')]: {
+          [buildTag(dav, 'privilege')]: [
+            { [buildTag(dav, 'read')]: '' },
+            { [buildTag(cal, 'schedule-deliver')]: '' }
+          ]
+        }
+      }
+    ];
+
+    setMultistatusResponse(ctx);
+    ctx.body = build(multistatus([response(ctx.url, status[200], props)]));
+  }
+
+  /**
+   * Handle GET on scheduling inboxbox - list scheduling messages
+   * GET /cal/:principalId/inbox/
+   *
+   * @see https://tools.ietf.org/html/rfc6638#section-2.2
+   */
+  async function getInbox(ctx) {
+    log.debug('GET inbox request', { url: ctx.url });
+
+    // Return empty collection by default
+    // Implementations can override via options.data.getSchedulingMessages
+    let messages = [];
+
+    try {
+      if (typeof options.data.getSchedulingMessages === 'function') {
+        messages = await options.data.getSchedulingMessages(ctx);
+      }
+    } catch (err) {
+      log.warn('Error getting scheduling messages', { error: err.message });
+    }
+
+    const responses = messages.map((msg) => {
+      return response(msg.href, status[200], [
+        { [buildTag(dav, 'getetag')]: msg.etag },
+        { [buildTag(dav, 'getcontenttype')]: 'text/calendar; charset=utf-8' },
+        { [buildTag(cal, 'calendar-data')]: msg.icalData }
+      ]);
+    });
+
+    // Add collection response
+    responses.unshift(
+      response(ctx.url, status[200], [
+        {
+          [buildTag(dav, 'resourcetype')]: {
+            [buildTag(dav, 'collection')]: '',
+            [buildTag(cal, 'schedule-inbox')]: ''
+          }
+        }
+      ])
+    );
+
+    setMultistatusResponse(ctx);
+    ctx.body = build(multistatus(responses));
+  }
+
+  /**
+   * Handle PROPFIND on scheduling outbox
+   * PROPFIND /cal/:principalId/outbox/
+   *
+   * @see https://tools.ietf.org/html/rfc6638#section-2.1
+   */
+  async function propfindOutbox(ctx) {
+    log.debug('PROPFIND outbox request', { url: ctx.url });
+
+    const props = [
+      {
+        [buildTag(dav, 'resourcetype')]: {
+          [buildTag(dav, 'collection')]: '',
+          [buildTag(cal, 'schedule-outbox')]: ''
+        }
+      },
+      { [buildTag(dav, 'displayname')]: 'Schedule Outbox' },
+      {
+        [buildTag(dav, 'current-user-privilege-set')]: {
+          [buildTag(dav, 'privilege')]: [
+            { [buildTag(dav, 'read')]: '' },
+            { [buildTag(cal, 'schedule-send')]: '' }
+          ]
+        }
+      }
+    ];
+
+    setMultistatusResponse(ctx);
+    ctx.body = build(multistatus([response(ctx.url, status[200], props)]));
+  }
+
+  /**
+   * Generate empty VFREEBUSY response
+   */
+  function generateEmptyFreeBusy(attendee) {
+    const now = new Date();
+    const dtstamp = now
+      .toISOString()
+      .replaceAll(/[-:]/g, '')
+      .replace(/\.\d{3}/, '');
+    const uid = `freebusy-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
+
+    return [
+      'BEGIN:VCALENDAR',
+      'VERSION:2.0',
+      'PRODID:-//Forward Email//CalDAV Adapter//EN',
+      'METHOD:REPLY',
+      'BEGIN:VFREEBUSY',
+      `DTSTAMP:${dtstamp}`,
+      `UID:${uid}`,
+      `ATTENDEE:mailto:${attendee}`,
+      'END:VFREEBUSY',
+      'END:VCALENDAR'
+    ].join('\r\n');
+  }
+
+  return {
+    postOutbox,
+    propfindInbox,
+    getInbox,
+    propfindOutbox,
+
+    /**
+     * Route handler for scheduling endpoints
+     */
+    async route(ctx) {
+      const method = ctx.method.toLowerCase();
+      const url = ctx.url.toLowerCase();
+
+      // Determine if this is inbox or outbox
+      const isInbox = url.includes('/inbox');
+      const isOutbox = url.includes('/outbox');
+
+      if (method === 'options') {
+        if (isOutbox) {
+          setOptions(ctx, ['OPTIONS', 'POST', 'PROPFIND']);
+        } else if (isInbox) {
+          setOptions(ctx, ['OPTIONS', 'GET', 'PROPFIND', 'DELETE']);
+        }
+
+        return;
+      }
+
+      if (isOutbox) {
+        if (method === 'post') {
+          return postOutbox(ctx);
+        }
+
+        if (method === 'propfind') {
+          return propfindOutbox(ctx);
+        }
+      }
+
+      if (isInbox) {
+        if (method === 'get') {
+          return getInbox(ctx);
+        }
+
+        if (method === 'propfind') {
+          return propfindInbox(ctx);
+        }
+      }
+
+      ctx.status = 405;
+      ctx.body = 'Method Not Allowed';
+    }
+  };
+};

package/test/scheduling.test.js

@@ -0,0 +1,697 @@
+const test = require('ava');
+
+// Mock options for testing
+const createMockOptions = (overrides = {}) => ({
+  data: {
+    getCalendarId: () => 'test-calendar',
+    buildICS: () => 'BEGIN:VCALENDAR\r\nEND:VCALENDAR',
+    getETag: () => '"test-etag"',
+    ...overrides.data
+  },
+  logEnabled: false,
+  ...overrides
+});
+
+// Mock Koa context
+const createMockCtx = (overrides = {}) => ({
+  method: 'GET',
+  url: '/cal/user@example.com/',
+  status: 200,
+  body: '',
+  request: {
+    body: ''
+  },
+  state: {
+    user: {
+      principalId: 'user@example.com',
+      principalName: 'user@example.com',
+      email: 'user@example.com'
+    },
+    params: {
+      principalId: 'user@example.com'
+    },
+    calendarHomeUrl: '/cal/user@example.com/',
+    principalUrl: '/p/user@example.com/',
+    calendarUrl: '/cal/user@example.com/default/'
+  },
+  set() {},
+  ...overrides
+});
+
+// ============================================
+// Tests for common/response.js DAV header
+// ============================================
+
+test('DAV header includes calendar-auto-schedule capability', (t) => {
+  const response = require('../common/response');
+
+  // Create a mock context to capture the header
+  let davHeader = '';
+  const ctx = {
+    status: 0,
+    body: '',
+    set(name, value) {
+      if (name === 'DAV') {
+        davHeader = value;
+      }
+    }
+  };
+
+  response.setOptions(ctx, ['OPTIONS']);
+
+  t.true(
+    davHeader.includes('calendar-auto-schedule'),
+    'DAV header should include calendar-auto-schedule'
+  );
+  t.true(
+    davHeader.includes('calendar-schedule'),
+    'DAV header should include calendar-schedule'
+  );
+  t.true(
+    davHeader.includes('calendar-access'),
+    'DAV header should include calendar-access'
+  );
+});
+
+// ============================================
+// Tests for common/tags.js scheduling properties
+// ============================================
+
+test('schedule-inbox-URL returns correct URL when calendarHomeUrl is set', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleInboxTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-inbox-URL'];
+  t.is(typeof scheduleInboxTag, 'object');
+  t.is(typeof scheduleInboxTag.resp, 'function');
+
+  const ctx = createMockCtx();
+  const result = await scheduleInboxTag.resp({ ctx });
+
+  t.truthy(result);
+  const tagKey = Object.keys(result)[0];
+  t.true(tagKey.includes('schedule-inbox-URL'));
+});
+
+test('schedule-outbox-URL returns correct URL when calendarHomeUrl is set', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleOutboxTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-outbox-URL'];
+  t.is(typeof scheduleOutboxTag, 'object');
+  t.is(typeof scheduleOutboxTag.resp, 'function');
+
+  const ctx = createMockCtx();
+  const result = await scheduleOutboxTag.resp({ ctx });
+
+  t.truthy(result);
+  const tagKey = Object.keys(result)[0];
+  t.true(tagKey.includes('schedule-outbox-URL'));
+});
+
+test('schedule-default-calendar-URL returns correct URL when calendarUrl is set', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleDefaultCalTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-default-calendar-URL'];
+  t.is(typeof scheduleDefaultCalTag, 'object');
+  t.is(typeof scheduleDefaultCalTag.resp, 'function');
+
+  const ctx = createMockCtx();
+  const result = await scheduleDefaultCalTag.resp({ ctx });
+
+  t.truthy(result);
+  const tagKey = Object.keys(result)[0];
+  t.true(tagKey.includes('schedule-default-calendar-URL'));
+});
+
+test('schedule-calendar-transp returns opaque by default', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleTranspTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-calendar-transp'];
+  t.is(typeof scheduleTranspTag, 'object');
+  t.is(typeof scheduleTranspTag.resp, 'function');
+
+  const calendar = { name: 'Test Calendar' };
+  const result = await scheduleTranspTag.resp({
+    resource: 'calendar',
+    calendar
+  });
+
+  t.truthy(result);
+  const tagKey = Object.keys(result)[0];
+  t.true(tagKey.includes('schedule-calendar-transp'));
+});
+
+test('schedule-calendar-transp respects calendar scheduleTransp property', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleTranspTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-calendar-transp'];
+
+  const calendar = { name: 'Test Calendar', scheduleTransp: 'transparent' };
+  const result = await scheduleTranspTag.resp({
+    resource: 'calendar',
+    calendar
+  });
+
+  t.truthy(result);
+  // The result should contain the transparent value
+  const resultStr = JSON.stringify(result);
+  t.true(resultStr.includes('transparent'));
+});
+
+test('schedule-tag returns value when event has scheduleTag', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleTagProp = tags['urn:ietf:params:xml:ns:caldav']['schedule-tag'];
+  t.is(typeof scheduleTagProp, 'object');
+  t.is(typeof scheduleTagProp.resp, 'function');
+
+  const event = { scheduleTag: '"schedule-tag-123"' };
+  const result = await scheduleTagProp.resp({ resource: 'event', event });
+
+  t.truthy(result);
+  const tagKey = Object.keys(result)[0];
+  t.true(tagKey.includes('schedule-tag'));
+});
+
+test('schedule-tag returns undefined when event has no scheduleTag', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleTagProp = tags['urn:ietf:params:xml:ns:caldav']['schedule-tag'];
+
+  const event = { uid: 'test-event' };
+  const result = await scheduleTagProp.resp({ resource: 'event', event });
+
+  t.is(result, undefined);
+});
+
+// ============================================
+// Tests for scheduling.js routes
+// ============================================
+
+test('scheduling module exports required functions', (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  t.is(typeof scheduling.postOutbox, 'function');
+  t.is(typeof scheduling.propfindInbox, 'function');
+  t.is(typeof scheduling.getInbox, 'function');
+  t.is(typeof scheduling.propfindOutbox, 'function');
+  t.is(typeof scheduling.route, 'function');
+});
+
+test('scheduling route handler sets OPTIONS for outbox', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  let allowHeader = '';
+  const ctx = createMockCtx({
+    method: 'OPTIONS',
+    url: '/cal/user@example.com/outbox/',
+    set(name, value) {
+      if (name === 'Allow') {
+        allowHeader = value;
+      }
+    }
+  });
+
+  await scheduling.route(ctx);
+
+  t.true(allowHeader.includes('POST'));
+  t.true(allowHeader.includes('PROPFIND'));
+});
+
+test('scheduling route handler sets OPTIONS for inbox', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  let allowHeader = '';
+  const ctx = createMockCtx({
+    method: 'OPTIONS',
+    url: '/cal/user@example.com/inbox/',
+    set(name, value) {
+      if (name === 'Allow') {
+        allowHeader = value;
+      }
+    }
+  });
+
+  await scheduling.route(ctx);
+
+  t.true(allowHeader.includes('GET'));
+  t.true(allowHeader.includes('PROPFIND'));
+  t.true(allowHeader.includes('DELETE'));
+});
+
+test('propfindInbox returns schedule-inbox resourcetype', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'PROPFIND',
+    url: '/cal/user@example.com/inbox/'
+  });
+
+  await scheduling.propfindInbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('schedule-inbox'));
+});
+
+test('propfindOutbox returns schedule-outbox resourcetype', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'PROPFIND',
+    url: '/cal/user@example.com/outbox/'
+  });
+
+  await scheduling.propfindOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('schedule-outbox'));
+});
+
+test('getInbox returns empty collection by default', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'GET',
+    url: '/cal/user@example.com/inbox/'
+  });
+
+  await scheduling.getInbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('schedule-inbox'));
+});
+
+test('getInbox uses options.data.getSchedulingMessages when available', async (t) => {
+  const mockMessages = [
+    {
+      href: '/cal/user@example.com/inbox/msg1.ics',
+      etag: '"etag1"',
+      icalData: 'BEGIN:VCALENDAR\r\nEND:VCALENDAR'
+    }
+  ];
+
+  const options = createMockOptions({
+    data: {
+      getSchedulingMessages: async () => mockMessages
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'GET',
+    url: '/cal/user@example.com/inbox/'
+  });
+
+  await scheduling.getInbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('msg1.ics'));
+});
+
+test('postOutbox returns 400 when body is missing', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: null }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 400);
+});
+
+test('postOutbox handles free-busy query', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const freeBusyRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VFREEBUSY',
+    'ORGANIZER:mailto:organizer@example.com',
+    'ATTENDEE:mailto:attendee@example.com',
+    'DTSTART:20260101T000000Z',
+    'DTEND:20260102T000000Z',
+    'END:VFREEBUSY',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: freeBusyRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('schedule-response'));
+  t.true(ctx.body.includes('attendee@example.com'));
+});
+
+test('postOutbox handles iTIP REQUEST', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const itipRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VEVENT',
+    'UID:test-event-123',
+    'ORGANIZER:mailto:organizer@example.com',
+    'ATTENDEE:mailto:attendee1@example.com',
+    'ATTENDEE:mailto:attendee2@example.com',
+    'SUMMARY:Test Meeting',
+    'DTSTART:20260115T100000Z',
+    'DTEND:20260115T110000Z',
+    'END:VEVENT',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: itipRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.truthy(ctx.body);
+  t.true(ctx.body.includes('schedule-response'));
+  t.true(ctx.body.includes('attendee1@example.com'));
+  t.true(ctx.body.includes('attendee2@example.com'));
+});
+
+test('postOutbox calls sendSchedulingMessage when available', async (t) => {
+  const sentMessages = [];
+
+  const options = createMockOptions({
+    data: {
+      async sendSchedulingMessage(ctx, msg) {
+        sentMessages.push(msg);
+      }
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const itipRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VEVENT',
+    'UID:test-event-456',
+    'ORGANIZER:mailto:organizer@example.com',
+    'ATTENDEE:mailto:attendee@example.com',
+    'SUMMARY:Test Meeting',
+    'DTSTART:20260115T100000Z',
+    'DTEND:20260115T110000Z',
+    'END:VEVENT',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: itipRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(sentMessages.length, 1);
+  t.is(sentMessages[0].method, 'REQUEST');
+  t.is(sentMessages[0].attendee, 'attendee@example.com');
+});
+
+test('postOutbox uses custom getFreeBusy when available', async (t) => {
+  const customFreeBusy = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REPLY',
+    'BEGIN:VFREEBUSY',
+    'FREEBUSY:20260101T090000Z/20260101T100000Z',
+    'END:VFREEBUSY',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const options = createMockOptions({
+    data: {
+      getFreeBusy: async () => customFreeBusy
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const freeBusyRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VFREEBUSY',
+    'ATTENDEE:mailto:attendee@example.com',
+    'END:VFREEBUSY',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: freeBusyRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  t.true(ctx.body.includes('FREEBUSY'));
+});
+
+// ============================================
+// Tests for calendar.js routing integration
+// ============================================
+
+test('calendar router routes inbox requests to scheduling handler', async (t) => {
+  // We need to test that the calendar.js properly routes to scheduling
+  // This is an integration test
+  const options = createMockOptions({
+    data: {
+      getCalendar: async () => null
+    }
+  });
+
+  const calendarRouter = require('../routes/calendar/calendar')(options);
+
+  const ctx = createMockCtx({
+    method: 'PROPFIND',
+    url: '/cal/user@example.com/inbox/'
+  });
+
+  await calendarRouter(ctx);
+
+  // If routing works, we should get a 207 response with schedule-inbox
+  t.is(ctx.status, 207);
+  t.true(ctx.body.includes('schedule-inbox'));
+});
+
+test('calendar router routes outbox requests to scheduling handler', async (t) => {
+  const options = createMockOptions({
+    data: {
+      getCalendar: async () => null
+    }
+  });
+
+  const calendarRouter = require('../routes/calendar/calendar')(options);
+
+  const ctx = createMockCtx({
+    method: 'PROPFIND',
+    url: '/cal/user@example.com/outbox/'
+  });
+
+  await calendarRouter(ctx);
+
+  t.is(ctx.status, 207);
+  t.true(ctx.body.includes('schedule-outbox'));
+});
+
+// ============================================
+// Tests for edge cases and error handling
+// ============================================
+
+test('schedule-inbox-URL returns empty href when ctx is missing', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleInboxTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-inbox-URL'];
+  const result = await scheduleInboxTag.resp({});
+
+  t.truthy(result);
+  // Should return empty href
+  const resultStr = JSON.stringify(result);
+  t.true(resultStr.includes('href'));
+});
+
+test('schedule-outbox-URL returns empty href when ctx is missing', async (t) => {
+  const options = createMockOptions();
+  const { tags } = require('../common/tags')(options);
+
+  const scheduleOutboxTag =
+    tags['urn:ietf:params:xml:ns:caldav']['schedule-outbox-URL'];
+  const result = await scheduleOutboxTag.resp({});
+
+  t.truthy(result);
+  const resultStr = JSON.stringify(result);
+  t.true(resultStr.includes('href'));
+});
+
+test('postOutbox handles errors in getFreeBusy gracefully', async (t) => {
+  const options = createMockOptions({
+    data: {
+      async getFreeBusy() {
+        throw new Error('Database error');
+      }
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const freeBusyRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VFREEBUSY',
+    'ATTENDEE:mailto:attendee@example.com',
+    'END:VFREEBUSY',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: freeBusyRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  // Should return error status 3.7 for invalid calendar user
+  t.true(ctx.body.includes('3.7'));
+});
+
+test('postOutbox handles errors in sendSchedulingMessage gracefully', async (t) => {
+  const options = createMockOptions({
+    data: {
+      async sendSchedulingMessage() {
+        throw new Error('SMTP error');
+      }
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const itipRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VEVENT',
+    'UID:test-event',
+    'ATTENDEE:mailto:attendee@example.com',
+    'END:VEVENT',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: itipRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 207);
+  // Should return error status 5.1 for delivery failure
+  t.true(ctx.body.includes('5.1'));
+});
+
+test('getInbox handles errors in getSchedulingMessages gracefully', async (t) => {
+  const options = createMockOptions({
+    data: {
+      async getSchedulingMessages() {
+        throw new Error('Database error');
+      }
+    }
+  });
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'GET',
+    url: '/cal/user@example.com/inbox/'
+  });
+
+  await scheduling.getInbox(ctx);
+
+  // Should still return 207 with empty collection
+  t.is(ctx.status, 207);
+  t.true(ctx.body.includes('schedule-inbox'));
+});
+
+test('scheduling route returns 405 for unsupported methods', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const ctx = createMockCtx({
+    method: 'PUT',
+    url: '/cal/user@example.com/outbox/'
+  });
+
+  await scheduling.route(ctx);
+
+  t.is(ctx.status, 405);
+});
+
+test('postOutbox returns 400 when no attendees in free-busy query', async (t) => {
+  const options = createMockOptions();
+  const scheduling = require('../routes/calendar/scheduling')(options);
+
+  const freeBusyRequest = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'METHOD:REQUEST',
+    'BEGIN:VFREEBUSY',
+    'ORGANIZER:mailto:organizer@example.com',
+    'END:VFREEBUSY',
+    'END:VCALENDAR'
+  ].join('\r\n');
+
+  const ctx = createMockCtx({
+    method: 'POST',
+    url: '/cal/user@example.com/outbox/',
+    request: { body: freeBusyRequest }
+  });
+
+  await scheduling.postOutbox(ctx);
+
+  t.is(ctx.status, 400);
+});