caldav-adapter 9.3.3 → 9.3.4

package/common/tags.js

@@ -182,14 +182,14 @@ module.exports = function (options) {
         doc: 'https://tools.ietf.org/html/rfc3253#section-3.1.5',
         async resp({ resource }) {
           if (resource === 'calCollection') {
+            //
+            // The calendar home collection itself does not support
+            // sync-collection or calendar-query — those are per-calendar.
+            // Return an empty supported-report-set to avoid confusing
+            // clients that check the home's capabilities.
+            //
             return {
-              [buildTag(dav, 'supported-report-set')]: {
-                [buildTag(dav, 'supported-report')]: {
-                  [buildTag(dav, 'report')]: {
-                    [buildTag(cal, 'sync-collection')]: ''
-                  }
-                }
-              }
+              [buildTag(dav, 'supported-report-set')]: ''
             };
           }
 
@@ -372,14 +372,29 @@ module.exports = function (options) {
       },
       'supported-calendar-component-set': {
         doc: 'https://tools.ietf.org/html/rfc4791#section-5.2.3',
-        async resp({ resource }) {
+        async resp({ resource, calendar }) {
           if (resource === 'calendar') {
+            //
+            // RFC 4791 Section 5.2.3: report only the component types
+            // that this calendar actually supports.  The calendar model
+            // exposes `has_vevent` and `has_vtodo` booleans; when both
+            // are absent/undefined we fall back to advertising both
+            // types for backward compatibility.
+            //
+            const hasVevent = calendar?.has_vevent !== false;
+            const hasVtodo = calendar?.has_vtodo !== false;
+            const comps = [];
+            if (hasVevent) comps.push({ '@name': 'VEVENT' });
+            if (hasVtodo) comps.push({ '@name': 'VTODO' });
+
+            // Safety: if somehow both are false, advertise both
+            if (comps.length === 0) {
+              comps.push({ '@name': 'VEVENT' }, { '@name': 'VTODO' });
+            }
+
             return {
               [buildTag(cal, 'supported-calendar-component-set')]: {
-                [buildTag(cal, 'comp')]: [
-                  { '@name': 'VEVENT' },
-                  { '@name': 'VTODO' }
-                ]
+                [buildTag(cal, 'comp')]: comps
               }
             };
           }

package/index.js

@@ -3,6 +3,15 @@ const { pathToRegexp } = require('path-to-regexp');
 const basicAuth = require('basic-auth');
 const parseBody = require('./common/parse-body');
 const winston = require('./common/winston');
+const { setMultistatusResponse } = require('./common/response');
+const {
+  build,
+  buildTag,
+  href,
+  multistatus,
+  response,
+  status
+} = require('./common/x-build');
 const cal = require('./routes/calendar/calendar');
 const pri = require('./routes/principal/principal');
 
@@ -135,6 +144,47 @@ module.exports = function (options) {
     }
   };
 
+  //
+  // RFC 4918 Section 9.1 / RFC 6764 Section 5:
+  // When a PROPFIND hits the root (caldavRoot), return a 207 multistatus
+  // with current-user-principal so clients can discover the principal URL
+  // without following redirects.  This is the standard CalDAV discovery
+  // flow: clients PROPFIND the root, read current-user-principal, then
+  // PROPFIND the principal URL for calendar-home-set.
+  //
+  // Previously the adapter returned a 302 redirect to /principals/,
+  // which some clients (notably iOS/macOS Calendar) do not follow
+  // correctly for PROPFIND requests.
+  //
+  const handleRootPropfind = function (ctx) {
+    const dav = 'DAV:';
+    const calNs = 'urn:ietf:params:xml:ns:caldav';
+
+    const props = [
+      {
+        [buildTag(dav, 'current-user-principal')]: href(ctx.state.principalUrl)
+      },
+      {
+        [buildTag(dav, 'resourcetype')]: {
+          [buildTag(dav, 'collection')]: ''
+        }
+      }
+    ];
+
+    // If the client also asked for calendar-home-set or principal-URL,
+    // include them so the client can skip the principal PROPFIND entirely
+    if (ctx.state.calendarHomeUrl) {
+      props.push({
+        [buildTag(calNs, 'calendar-home-set')]: href(ctx.state.calendarHomeUrl)
+      });
+    }
+
+    const resps = response(ctx.url, status[200], props);
+    const ms = multistatus([resps]);
+    setMultistatusResponse(ctx);
+    ctx.body = build(ms);
+  };
+
   return async function (ctx, next) {
     // use 301 permanent redirect per RFC 6764 Section 5
     if (
@@ -169,7 +219,18 @@ module.exports = function (options) {
       await calendarRoutes(ctx);
     } else if (principalRegex.regexp.test(ctx.path)) {
       await principalRoutes(ctx);
+    } else if (ctx.method.toLowerCase() === 'propfind') {
+      //
+      // Handle PROPFIND at the root URL (caldavRoot).
+      // Return 207 with current-user-principal so CalDAV clients
+      // can discover the principal URL without following redirects.
+      //
+      handleRootPropfind(ctx);
     } else {
+      //
+      // For non-PROPFIND methods at the root (e.g. OPTIONS handled
+      // upstream, or unexpected methods), redirect to the principal URL.
+      //
       ctx.redirect(principalRoute);
       return;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "caldav-adapter",
   "description": "CalDAV server for Node.js and Koa. Modernized and maintained for Forward Email.",
-  "version": "9.3.3",
+  "version": "9.3.4",
   "author": "Sanders DeNardi and Forward Email LLC",
   "contributors": [
     "Sanders DeNardi <sedenardi@gmail.com> (http://www.sandersdenardi.com/)",

package/routes/calendar/calendar/calendar-query.js

@@ -8,22 +8,57 @@ module.exports = function (options) {
   const eventResponse = calEventResponse(options);
   return async function (ctx, calendar) {
     /* https://tools.ietf.org/html/rfc4791#section-9.9 */
-    const veventFilters = xml.get(
+
+    //
+    // Step 1: Detect which component type the client is filtering on.
+    //
+    // Clients may send comp-filter with or without a nested time-range.
+    // We first check for time-range filters (used for date-bounded queries),
+    // then fall back to bare comp-filter elements (used for type-only queries).
+    //
+    // Example with time-range (Fantastical, iOS date-range sync):
+    //   <C:comp-filter name="VCALENDAR">
+    //     <C:comp-filter name="VEVENT">
+    //       <C:time-range start="..." end="..."/>
+    //     </C:comp-filter>
+    //   </C:comp-filter>
+    //
+    // Example without time-range (iOS initial sync, etag-only fetch):
+    //   <C:comp-filter name="VCALENDAR">
+    //     <C:comp-filter name="VEVENT"/>
+    //   </C:comp-filter>
+    //
+    const veventTimeRange = xml.get(
       "/CAL:calendar-query/CAL:filter/CAL:comp-filter[@name='VCALENDAR']/CAL:comp-filter[@name='VEVENT']/CAL:time-range",
       ctx.request.xml
     );
-    const vtodoFilters = xml.get(
+    const vtodoTimeRange = xml.get(
       "/CAL:calendar-query/CAL:filter/CAL:comp-filter[@name='VCALENDAR']/CAL:comp-filter[@name='VTODO']/CAL:time-range",
       ctx.request.xml
     );
 
-    const filters = veventFilters.length > 0 ? veventFilters : vtodoFilters;
-    const componentType =
-      veventFilters.length > 0
-        ? 'VEVENT'
-        : vtodoFilters.length > 0
-          ? 'VTODO'
-          : null;
+    // Also detect bare comp-filter (no time-range child) for component type
+    const veventCompFilter = xml.get(
+      "/CAL:calendar-query/CAL:filter/CAL:comp-filter[@name='VCALENDAR']/CAL:comp-filter[@name='VEVENT']",
+      ctx.request.xml
+    );
+    const vtodoCompFilter = xml.get(
+      "/CAL:calendar-query/CAL:filter/CAL:comp-filter[@name='VCALENDAR']/CAL:comp-filter[@name='VTODO']",
+      ctx.request.xml
+    );
+
+    // Time-range filters take priority (date-bounded query)
+    const timeRangeFilters =
+      veventTimeRange.length > 0 ? veventTimeRange : vtodoTimeRange;
+
+    // Determine component type from either time-range or bare comp-filter
+    let componentType = null;
+    if (veventTimeRange.length > 0 || veventCompFilter.length > 0) {
+      componentType = 'VEVENT';
+    } else if (vtodoTimeRange.length > 0 || vtodoCompFilter.length > 0) {
+      componentType = 'VTODO';
+    }
+
     const { children } = xml.getWithChildren(
       '/CAL:calendar-query/D:prop',
       ctx.request.xml
@@ -32,7 +67,11 @@ module.exports = function (options) {
       return child.localName === 'calendar-data';
     });
 
-    if (!filters?.[0]) {
+    //
+    // Step 2: If no time-range filter, return all events for the
+    // requested component type (or all types if no comp-filter).
+    //
+    if (timeRangeFilters.length === 0) {
       const events = await options.data.getEventsForCalendar(ctx, {
         principalId: ctx.state.params.principalId,
         calendarId: options.data.getCalendarId(ctx, calendar),
@@ -60,7 +99,10 @@ module.exports = function (options) {
     // TODO: what else (?)
     //
 
-    const filter = filters[0];
+    //
+    // Step 3: Parse time-range attributes and query by date.
+    //
+    const filter = timeRangeFilters[0];
     const startAttr = _.find(filter.attributes, { localName: 'start' });
     const endAttr = _.find(filter.attributes, { localName: 'end' });
 

package/routes/calendar/user/propfind.js

@@ -16,19 +16,36 @@ module.exports = function (options) {
   const tags = commonTags(options);
 
   const exec = async function (ctx) {
-    // Handle missing or invalid XML body gracefully
-    // This can happen when the client connection is interrupted
-    // or the body was not received properly
-    if (!ctx.request.xml) {
+    // RFC 4918 Section 9.1: an empty PROPFIND body
+    // MUST be treated as an allprop request
+    let children = [];
+    if (ctx.request.xml) {
+      ({ children } = xml.getWithChildren(
+        '/D:propfind/D:prop',
+        ctx.request.xml
+      ));
+    } else {
       log.warn('PROPFIND request received with missing or invalid XML body');
-      // Return a minimal valid response for allprop
-      // RFC 4918 Section 9.1: If no body is included, the request MUST be treated as allprop
     }
 
-    const { children } = xml.getWithChildren(
-      '/D:propfind/D:prop',
-      ctx.request.xml
-    );
+    //
+    // If no properties were requested (allprop or empty body), return
+    // the default set of properties that CalDAV clients need for
+    // calendar home discovery.
+    //
+    const dav = 'DAV:';
+    const cs = 'http://calendarserver.org/ns/';
+    if (children.length === 0) {
+      children = [
+        { namespaceURI: dav, localName: 'displayname' },
+        { namespaceURI: dav, localName: 'resourcetype' },
+        { namespaceURI: dav, localName: 'current-user-principal' },
+        { namespaceURI: dav, localName: 'current-user-privilege-set' },
+        { namespaceURI: dav, localName: 'supported-report-set' },
+        { namespaceURI: cs, localName: 'getctag' }
+      ];
+    }
+
     const checksum = _.some(
       children,
       (child) => child.localName === 'checksum-versions'

package/routes/principal/principal.js

@@ -6,16 +6,22 @@ const {
 } = require('../../common/response');
 const winston = require('../../common/winston');
 const routePropfind = require('./propfind');
-const routeGet = require('./get'); // New GET handler
+const routeGet = require('./get');
 const routeMkCalendar = require('./mkcalendar');
-// const routeReport = require('./report');
+const routeReport = require('./report');
 
 module.exports = function (options) {
   const log = winston({ ...options, label: 'principal' });
   const methods = {
     propfind: routePropfind(options),
-    get: routeGet(options), // Use proper GET handler instead of reusing PROPFIND
-    // report: reportReport(opts)
+    get: routeGet(options),
+    //
+    // RFC 3744 Section 9.4/9.5: principal-property-search and
+    // principal-search-property-set are REPORT methods on the
+    // principal resource.  Some clients (including Apple Calendar)
+    // use these during discovery.
+    //
+    report: routeReport(options),
     //
     // TODO: proppatch
     // NOTE: fennel implements this with 403 forbidden
@@ -28,7 +34,7 @@ module.exports = function (options) {
     const method = ctx.method.toLowerCase();
 
     if (method === 'options') {
-      setOptions(ctx, ['OPTIONS', 'PROPFIND', 'GET']);
+      setOptions(ctx, ['OPTIONS', 'PROPFIND', 'REPORT', 'GET']);
       return;
     }