Mario Fetka
45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# CalDAV and CardDAV
|
|
|
|
Bongo exposes a user's calendar and address book through the Web service so
|
|
Thunderbird and other DAV clients see the same objects as Bongo Webmail.
|
|
Calendar resources are iCalendar documents; contact resources are vCards.
|
|
|
|
## Discovery and paths
|
|
|
|
Clients may use `/.well-known/caldav` and `/.well-known/carddav` discovery.
|
|
Authenticated homes use these forms:
|
|
|
|
```text
|
|
/calendars/USER/personal/
|
|
/addressbooks/USER/personal/
|
|
```
|
|
|
|
Calendar objects end in `.ics`; address-book objects end in `.vcf`. The
|
|
authenticated user may access only that user's home. Resource names are
|
|
decoded and validated before being mapped to Store paths, preventing encoded
|
|
slashes, traversal, NUL bytes, or another account name from escaping the
|
|
personal collection.
|
|
|
|
## HTTP and DAV behaviour
|
|
|
|
The service supports `OPTIONS`, `GET`, `HEAD`, `PUT`, `DELETE`, `PROPFIND`,
|
|
and `REPORT` for the implemented calendar and address-book resources.
|
|
Depth-aware multistatus responses describe the principal, home, personal
|
|
collection, and objects. Calendar multiget/query and address-book multiget
|
|
read the requested resources. ETags and `If-Match`/`If-None-Match` protect
|
|
updates against accidental overwrite.
|
|
|
|
Incoming iCalendar and vCard payloads are parsed strictly and bounded by the
|
|
Web request and object-size limits. Bongo preserves the canonical source data
|
|
needed for lossless DAV round trips while also mapping useful fields into the
|
|
Store model used by Webmail. Calendar events include recurrence and the
|
|
standard date/time data supported by the converter; contacts include
|
|
structured names, multiple email addresses and telephone numbers,
|
|
organization, birthday/anniversary, URL, note, and postal address fields.
|
|
|
|
DAV authentication follows the Web master/app-password scope and external
|
|
TLS policy. When a reverse proxy terminates TLS, it must pass DAV methods and
|
|
bodies unchanged and use the same trusted-proxy configuration as Webmail.
|
|
The release gate tests discovery, CRUD, reports, ETags, isolation, and
|
|
TLS/proxy policy under DAV-01 through DAV-03.
|