bongo/docs/dav.md

CalDAV and CardDAV

Bongo exposes a user's calendar and address book through the Web service so Thunderbird and other DAV clients see the same objects as Bongo Webmail. Calendar resources are iCalendar documents; contact resources are vCards.

Discovery and paths

Clients may use /.well-known/caldav and /.well-known/carddav discovery. Authenticated homes use these forms:

/calendars/USER/personal/
/addressbooks/USER/personal/

Calendar objects end in .ics; address-book objects end in .vcf. The authenticated user may access only that user's home. Resource names are decoded and validated before being mapped to Store paths, preventing encoded slashes, traversal, NUL bytes, or another account name from escaping the personal collection.

HTTP and DAV behaviour

The service supports OPTIONS, GET, HEAD, PUT, DELETE, PROPFIND, and REPORT for the implemented calendar and address-book resources. Depth-aware multistatus responses describe the principal, home, personal collection, and objects. Calendar multiget/query and address-book multiget read the requested resources. ETags and If-Match/If-None-Match protect updates against accidental overwrite.

Incoming iCalendar and vCard payloads are parsed strictly and bounded by the Web request and object-size limits. Bongo preserves the canonical source data needed for lossless DAV round trips while also mapping useful fields into the Store model used by Webmail. Calendar events include recurrence and the standard date/time data supported by the converter; contacts include structured names, multiple email addresses and telephone numbers, organization, birthday/anniversary, URL, note, and postal address fields.

DAV authentication follows the Web master/app-password scope and external TLS policy. When a reverse proxy terminates TLS, it must pass DAV methods and bodies unchanged and use the same trusted-proxy configuration as Webmail. The release gate tests discovery, CRUD, reports, ETags, isolation, and TLS/proxy policy under DAV-01 through DAV-03.