CalDAV: vdirsyncer upload is forbidden with full access app password #1299

Open
opened 2026-10-07 02:32:45 +00:00 by kayg · 2 comments
Owner

Steps

  1. Start a fresh local server and create a User with a full-access CalDAV app password.
  2. Configure vdirsyncer 0.21.0 with the User's /dav/ endpoint and a filesystem vdir.
  3. Run vdirsyncer discover and vdirsyncer sync; discovery and the empty sync succeed.
  4. Create an event in the local vdir with khal, including a Unicode summary, then run vdirsyncer sync again.

Expected

The full-access CalDAV credential can create the new calendar object, and the event appears on the server.

Actual

The upload to /dav/calendars/{user}/untagged/{uid}.ics returns HTTP 403 Forbidden. The client event remains local and does not reach the server.

Evidence

artifacts/bash-interop/caldav-vdirsyncer-403.log from the real server and vdirsyncer 0.21.0.

Severity: major

## Steps 1. Start a fresh local server and create a User with a full-access CalDAV app password. 2. Configure vdirsyncer 0.21.0 with the User's `/dav/` endpoint and a filesystem vdir. 3. Run `vdirsyncer discover` and `vdirsyncer sync`; discovery and the empty sync succeed. 4. Create an event in the local vdir with khal, including a Unicode summary, then run `vdirsyncer sync` again. ## Expected The full-access CalDAV credential can create the new calendar object, and the event appears on the server. ## Actual The upload to `/dav/calendars/{user}/untagged/{uid}.ics` returns HTTP 403 Forbidden. The client event remains local and does not reach the server. ## Evidence `artifacts/bash-interop/caldav-vdirsyncer-403.log` from the real server and vdirsyncer 0.21.0. Severity: major
Author
Owner

Fixed on job/bash-interop in a1c165256. vdirsyncer can now upload khal opaque UIDs under its client-chosen href; the server stores a reversible safe block ID and returns the canonical Location. Regression coverage uses a captured khal 0.14.1 event, create/update If-Match, GET and sync-collection. Gates: calternal-dav clippy and tests pass.

Fixed on job/bash-interop in a1c165256. vdirsyncer can now upload khal opaque UIDs under its client-chosen href; the server stores a reversible safe block ID and returns the canonical Location. Regression coverage uses a captured khal 0.14.1 event, create/update If-Match, GET and sync-collection. Gates: calternal-dav clippy and tests pass.
Author
Owner

Fixed in a1c165256 (Fix vdirsyncer CalDAV event uploads). The failure came from treating a CalDAV UID as a Notes block ID and requiring the initial resource href to equal that UID. New client UIDs now map reversibly to safe block IDs, client-chosen hrefs are accepted within a bounded URI-safe character set, and new objects return a canonical Location.

Verified with vdirsyncer 0.21.0 and khal 0.14.1 against the local production server: a client-created event with a Unicode summary appeared in the UI, then a UI rename synchronized back to the client. The regression fixture is crates/calternal-dav/tests/fixtures/vdirsyncer/khal-0.14.1-created.ics; test evidence is in artifacts/bash-interop/caldav-vdirsyncer-403.log. cargo test -p calternal-dav passed (62 unit tests and 38 replay tests).

Fixed in `a1c165256` (`Fix vdirsyncer CalDAV event uploads`). The failure came from treating a CalDAV UID as a Notes block ID and requiring the initial resource href to equal that UID. New client UIDs now map reversibly to safe block IDs, client-chosen hrefs are accepted within a bounded URI-safe character set, and new objects return a canonical `Location`. Verified with vdirsyncer 0.21.0 and khal 0.14.1 against the local production server: a client-created event with a Unicode summary appeared in the UI, then a UI rename synchronized back to the client. The regression fixture is `crates/calternal-dav/tests/fixtures/vdirsyncer/khal-0.14.1-created.ics`; test evidence is in `artifacts/bash-interop/caldav-vdirsyncer-403.log`. `cargo test -p calternal-dav` passed (62 unit tests and 38 replay tests).
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1299
No description provided.