M4: Calendar plugin (builtin) + mail HTML/attachment fixes
Calendar plugin (webmail_plugin_calendar, non-removable core plugin): - Local calendars/events CRUD with RLS isolation; recurrence expanded at query time (DST-correct), EXDATE + detached-override merge. - Calendar app bundle: month/week/day/3-day views, mini-month, event form (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient autocomplete, Jitsi video call), event popover with RSVP badges, resizable/ collapsible left panel + theme toggle, overlap layout. - iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML + text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token) records accepted/declined/tentative per attendee. - "This and following" edit + scoped delete (this / this-and-following), with a delete confirmation dialog for recurring events. Core: - Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations section; date order follows time format (en-GB vs en-US) across Mail. - Plugin SDK: mail (send from a user's account), vault (envelope encrypt), multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed PluginPage. Mail HTML rendering: - Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like, strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so already-indexed mail re-sanitizes on view. - Attachments: a Content-Disposition: attachment part is a real attachment even when it also carries a Content-ID (fixes hidden invite.ics). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.8
@@ -12,6 +12,7 @@ from __future__ import annotations
|
||||
import asyncio
|
||||
import ipaddress
|
||||
import socket
|
||||
from dataclasses import dataclass
|
||||
from urllib.parse import urlsplit
|
||||
|
||||
import httpx
|
||||
@@ -87,3 +88,51 @@ async def guarded_get(url: str) -> str | None:
|
||||
raise SsrfError("response exceeds 256 KB cap")
|
||||
chunks.append(chunk)
|
||||
return b"".join(chunks).decode("utf-8", "replace")
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class GuardedResponse:
|
||||
status: int
|
||||
headers: dict[str, str]
|
||||
text: str
|
||||
|
||||
|
||||
async def guarded_request(
|
||||
method: str,
|
||||
url: str,
|
||||
*,
|
||||
headers: dict[str, str] | None = None,
|
||||
content: bytes | str | None = None,
|
||||
auth: tuple[str, str] | None = None,
|
||||
timeout: float = 15.0, # noqa: ASYNC109 - passed straight to httpx's own timeout
|
||||
max_bytes: int = 25 * 1024 * 1024,
|
||||
) -> GuardedResponse:
|
||||
"""Arbitrary-method HTTPS request under the same SSRF policy as :func:`guarded_get`.
|
||||
|
||||
Used by plugins that speak WebDAV/CalDAV/CardDAV (PROPFIND/REPORT/PUT/DELETE) or
|
||||
fetch ICS feeds. HTTPS-only, public host required, no off-domain redirects, body
|
||||
capped at ``max_bytes``. ``auth`` is an (user, password) basic-auth pair. Returns
|
||||
status + headers + body (all statuses; the caller decides what's an error)."""
|
||||
parts = urlsplit(url)
|
||||
if parts.scheme != "https":
|
||||
raise SsrfError("only https is permitted")
|
||||
if not parts.hostname:
|
||||
raise SsrfError("missing host")
|
||||
await assert_host_is_public(parts.hostname)
|
||||
|
||||
async with (
|
||||
httpx.AsyncClient(follow_redirects=False, timeout=timeout, auth=auth) as client,
|
||||
client.stream(method, url, headers=headers, content=content) as resp,
|
||||
):
|
||||
chunks: list[bytes] = []
|
||||
total = 0
|
||||
async for chunk in resp.aiter_bytes():
|
||||
total += len(chunk)
|
||||
if total > max_bytes:
|
||||
raise SsrfError("response exceeds size cap")
|
||||
chunks.append(chunk)
|
||||
return GuardedResponse(
|
||||
status=resp.status_code,
|
||||
headers=dict(resp.headers),
|
||||
text=b"".join(chunks).decode("utf-8", "replace"),
|
||||
)
|
||||
|
||||
@@ -18,17 +18,22 @@ router = APIRouter(prefix="/settings", tags=["settings"])
|
||||
DbSession = Annotated[AsyncSession, Depends(get_session)]
|
||||
|
||||
_ALLOWED_ORDER = {"asc", "desc"}
|
||||
_ALLOWED_TIME_FORMAT = {"12", "24"}
|
||||
|
||||
|
||||
class SettingsOut(BaseModel):
|
||||
thread_order: str = "asc"
|
||||
tz: str = "UTC"
|
||||
time_format: str = "24" # 12 = AM/PM, 24 = 24-hour (default); applies app-wide
|
||||
jitsi_server: str = "" # blank => https://meet.jit.si/
|
||||
allowed_image_senders: list[str] = []
|
||||
|
||||
|
||||
class SettingsPatch(BaseModel):
|
||||
thread_order: str | None = None
|
||||
tz: str | None = None
|
||||
time_format: str | None = None
|
||||
jitsi_server: str | None = None
|
||||
|
||||
|
||||
class QuotaOut(BaseModel):
|
||||
@@ -56,6 +61,8 @@ def _settings_out(user: User) -> SettingsOut:
|
||||
return SettingsOut(
|
||||
thread_order=str(s.get("thread_order", "asc")),
|
||||
tz=str(s.get("tz", "UTC")),
|
||||
time_format=str(s.get("time_format", "24")),
|
||||
jitsi_server=str(s.get("jitsi_server", "")),
|
||||
allowed_image_senders=sorted(allowed_image_senders(user)),
|
||||
)
|
||||
|
||||
@@ -81,6 +88,10 @@ async def patch_settings(body: SettingsPatch, user: CurrentUser, db: DbSession)
|
||||
updates["thread_order"] = body.thread_order
|
||||
if body.tz is not None:
|
||||
updates["tz"] = body.tz
|
||||
if body.time_format is not None and body.time_format in _ALLOWED_TIME_FORMAT:
|
||||
updates["time_format"] = body.time_format
|
||||
if body.jitsi_server is not None:
|
||||
updates["jitsi_server"] = body.jitsi_server.strip()
|
||||
user.settings = updates
|
||||
await db.commit()
|
||||
return _settings_out(user)
|
||||
|
||||
@@ -98,16 +98,23 @@ def _extract_attachments(msg: EmailMessage) -> list[ParsedAttachment]:
|
||||
continue
|
||||
cid = part.get("Content-ID")
|
||||
filename = part.get_filename()
|
||||
if not (filename or cid or part.get_content_disposition() == "attachment"):
|
||||
disposition = part.get_content_disposition()
|
||||
if not (filename or cid or disposition == "attachment"):
|
||||
continue
|
||||
payload = part.get_payload(decode=True)
|
||||
if not isinstance(payload, bytes):
|
||||
continue
|
||||
# A part is an INLINE resource (cid: image rendered in-body, hidden from the
|
||||
# attachment list) only when it carries a Content-ID AND is not explicitly an
|
||||
# attachment. A part marked `Content-Disposition: attachment` is a real
|
||||
# attachment even when it also has a Content-ID (e.g. Fastmail's invite.ics),
|
||||
# so we drop the cid for it and it shows as a downloadable chip.
|
||||
inline = cid is not None and disposition != "attachment"
|
||||
out.append(
|
||||
ParsedAttachment(
|
||||
filename=filename or "attachment",
|
||||
mime_type=part.get_content_type(),
|
||||
content_id=cid.strip("<>") if cid else None,
|
||||
content_id=cid.strip("<>") if (inline and cid is not None) else None,
|
||||
payload=payload,
|
||||
)
|
||||
)
|
||||
|
||||
@@ -17,7 +17,7 @@ import nh3
|
||||
|
||||
# Bump when the sanitization policy changes; body_parts.sanitizer_v records it so a
|
||||
# render re-sanitizes stale content from the raw blob (SPEC §10.4).
|
||||
SANITIZER_VERSION = 2
|
||||
SANITIZER_VERSION = 3
|
||||
|
||||
_ALLOWED_TAGS: set[str] = {
|
||||
# structure
|
||||
@@ -76,6 +76,7 @@ _ALLOWED_TAGS: set[str] = {
|
||||
"span",
|
||||
"strike",
|
||||
"strong",
|
||||
"style",
|
||||
"sub",
|
||||
"summary",
|
||||
"sup",
|
||||
@@ -97,6 +98,7 @@ _ALLOWED_TAGS: set[str] = {
|
||||
# Attributes allowed on any tag (presentational email formatting).
|
||||
_GENERIC_ATTRS: set[str] = {
|
||||
"style",
|
||||
"class",
|
||||
"align",
|
||||
"valign",
|
||||
"dir",
|
||||
@@ -119,6 +121,7 @@ _TAG_SPECIFIC: dict[str, set[str]] = {
|
||||
"th": {"colspan", "rowspan", "scope"},
|
||||
"table": {"cellpadding", "cellspacing", "border"},
|
||||
"font": {"face", "color", "size"},
|
||||
"style": {"type", "media"},
|
||||
}
|
||||
|
||||
# nh3 has no "generic attributes" option, so expand the generic set onto every tag.
|
||||
@@ -132,6 +135,12 @@ _STYLE_DANGEROUS = re.compile(
|
||||
r"(expression\s*\(|javascript:|vbscript:|@import|-moz-binding|behavior\s*:)", re.IGNORECASE
|
||||
)
|
||||
_STYLE_URL = re.compile(r"url\s*\([^)]*\)", re.IGNORECASE)
|
||||
# Script-like CSS that voids a whole <style> block (unlike @import, which we can strip).
|
||||
_STYLE_BLOCK_DANGEROUS = re.compile(
|
||||
r"(expression\s*\(|javascript:|vbscript:|-moz-binding|behavior\s*:)", re.IGNORECASE
|
||||
)
|
||||
_STYLE_IMPORT = re.compile(r"@import[^;]*;?", re.IGNORECASE)
|
||||
_STYLE_ELEMENT = re.compile(r"(<style\b[^>]*>)(.*?)(</style>)", re.IGNORECASE | re.DOTALL)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
@@ -150,6 +159,28 @@ def _sanitize_style(value: str, allow_remote: bool) -> str | None:
|
||||
return value
|
||||
|
||||
|
||||
def _sanitize_style_elements(html: str, allow_remote: bool, state: dict[str, bool]) -> str:
|
||||
"""Sanitize CSS inside ``<style>`` blocks (nh3 keeps the tag but not its text).
|
||||
|
||||
Many mailers (e.g. Fastmail's calendar invites) put all layout in a ``<style>``
|
||||
block of class rules — dropping it loses tables/buttons entirely. We keep the
|
||||
block but neutralize script-like CSS and, unless remote images are approved,
|
||||
strip ``@import``/``url()`` so it can't fetch remote/tracking resources.
|
||||
"""
|
||||
|
||||
def repl(match: re.Match[str]) -> str:
|
||||
css = match.group(2)
|
||||
if _STYLE_BLOCK_DANGEROUS.search(css):
|
||||
return "" # nuke the block entirely
|
||||
css = _STYLE_IMPORT.sub("", css)
|
||||
if not allow_remote and _STYLE_URL.search(css):
|
||||
state["has_remote"] = True
|
||||
css = _STYLE_URL.sub("none", css)
|
||||
return f"{match.group(1)}{css}{match.group(3)}"
|
||||
|
||||
return _STYLE_ELEMENT.sub(repl, html)
|
||||
|
||||
|
||||
def sanitize_html(
|
||||
html: str, message_id: uuid.UUID, *, allow_remote_images: bool = False
|
||||
) -> SanitizeResult:
|
||||
@@ -186,8 +217,12 @@ def sanitize_html(
|
||||
url_schemes=_URL_SCHEMES,
|
||||
link_rel="noopener noreferrer nofollow",
|
||||
strip_comments=True,
|
||||
# nh3 strips <script>/<style> *content* by default; we allow <style> (above)
|
||||
# and sanitize its CSS ourselves, so only script content is stripped here.
|
||||
clean_content_tags={"script"},
|
||||
attribute_filter=attribute_filter,
|
||||
)
|
||||
cleaned = _sanitize_style_elements(cleaned, allow_remote_images, state)
|
||||
return SanitizeResult(
|
||||
html=cleaned,
|
||||
has_remote_images=state["has_remote"],
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
"""SSRF-guarded, multi-method HTTP client exposed to plugins (SPEC §10.6).
|
||||
|
||||
``sdk.http_get`` covers simple GETs; heavy plugins that speak CalDAV/CardDAV need
|
||||
other verbs (PROPFIND/REPORT/PUT/DELETE) with request bodies and basic auth. This
|
||||
facade routes all of them through the same SSRF policy (HTTPS-only, public host,
|
||||
no off-domain redirects, size cap) and returns status + headers + body.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from app.accounts.ssrf import GuardedResponse, guarded_request
|
||||
|
||||
|
||||
class PluginHttp:
|
||||
async def request(
|
||||
self,
|
||||
method: str,
|
||||
url: str,
|
||||
*,
|
||||
headers: dict[str, str] | None = None,
|
||||
content: bytes | str | None = None,
|
||||
auth: tuple[str, str] | None = None,
|
||||
) -> GuardedResponse:
|
||||
return await guarded_request(
|
||||
method, url, headers=headers, content=content, auth=auth
|
||||
)
|
||||
|
||||
async def get(self, url: str, **kw: object) -> GuardedResponse:
|
||||
return await self.request("GET", url, **kw) # type: ignore[arg-type]
|
||||
|
||||
async def put(self, url: str, **kw: object) -> GuardedResponse:
|
||||
return await self.request("PUT", url, **kw) # type: ignore[arg-type]
|
||||
|
||||
async def delete(self, url: str, **kw: object) -> GuardedResponse:
|
||||
return await self.request("DELETE", url, **kw) # type: ignore[arg-type]
|
||||
|
||||
async def propfind(self, url: str, **kw: object) -> GuardedResponse:
|
||||
return await self.request("PROPFIND", url, **kw) # type: ignore[arg-type]
|
||||
|
||||
async def report(self, url: str, **kw: object) -> GuardedResponse:
|
||||
return await self.request("REPORT", url, **kw) # type: ignore[arg-type]
|
||||
@@ -0,0 +1,113 @@
|
||||
"""Send an email *as the user*, from one of their own accounts (SPEC §11 SDK).
|
||||
|
||||
Heavy plugins (calendar iMIP invites, later contacts) need to send a message
|
||||
through the organizer's real mailbox — reusing the same SMTP path as the compose
|
||||
outbox, but with a plugin-built body (e.g. a ``text/calendar; method=REQUEST``
|
||||
part). This helper looks up the user's account, assembles the MIME, and sends via
|
||||
the account's provider. It is exposed as ``sdk(name).mail`` so plugins never touch
|
||||
``app.providers`` / ``app.sync`` directly.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import uuid
|
||||
from datetime import UTC, datetime
|
||||
from email.mime.application import MIMEApplication
|
||||
from email.mime.multipart import MIMEMultipart
|
||||
from email.mime.text import MIMEText
|
||||
from email.utils import format_datetime, make_msgid
|
||||
|
||||
from sqlalchemy import select
|
||||
|
||||
from app.db import session_scope
|
||||
from app.models import Account
|
||||
from app.sync.provider_factory import build_provider
|
||||
|
||||
|
||||
class PluginMailError(Exception):
|
||||
"""No usable account, or the send failed."""
|
||||
|
||||
|
||||
class PluginMail:
|
||||
"""Send outbound mail from one of a user's own accounts."""
|
||||
|
||||
async def send(
|
||||
self,
|
||||
user_id: uuid.UUID,
|
||||
*,
|
||||
to: list[str],
|
||||
subject: str,
|
||||
html: str,
|
||||
text: str,
|
||||
from_email: str | None = None,
|
||||
ics: str | None = None,
|
||||
ics_method: str = "REQUEST",
|
||||
ics_filename: str = "invite.ics",
|
||||
) -> None:
|
||||
"""Send an email to ``to`` from the user's account.
|
||||
|
||||
``from_email`` selects which of the user's accounts to send from (falls
|
||||
back to their first account). When ``ics`` is given it is added both as a
|
||||
``text/calendar; method=<ics_method>`` alternative (so the recipient's
|
||||
client shows its native RSVP UI) and as a downloadable attachment.
|
||||
"""
|
||||
recipients = [r for r in (to or []) if r]
|
||||
if not recipients:
|
||||
return
|
||||
async with session_scope() as session:
|
||||
account = None
|
||||
if from_email:
|
||||
account = await session.scalar(
|
||||
select(Account).where(
|
||||
Account.user_id == user_id,
|
||||
Account.email == from_email,
|
||||
)
|
||||
)
|
||||
if account is None:
|
||||
account = await session.scalar(
|
||||
select(Account).where(Account.user_id == user_id).order_by(Account.created_at)
|
||||
)
|
||||
if account is None:
|
||||
raise PluginMailError("no account to send from")
|
||||
raw = _build_message(
|
||||
account, recipients, subject, html, text, ics, ics_method, ics_filename
|
||||
)
|
||||
envelope_from = account.email
|
||||
provider = build_provider(account)
|
||||
await provider.send(raw, envelope_from, recipients)
|
||||
|
||||
|
||||
def _build_message(
|
||||
account: Account,
|
||||
to: list[str],
|
||||
subject: str,
|
||||
html: str,
|
||||
text: str,
|
||||
ics: str | None,
|
||||
ics_method: str,
|
||||
ics_filename: str,
|
||||
) -> bytes:
|
||||
root = MIMEMultipart("mixed")
|
||||
from_name = account.display_name or ""
|
||||
root["From"] = f"{from_name} <{account.email}>" if from_name else account.email
|
||||
root["To"] = ", ".join(to)
|
||||
root["Subject"] = subject
|
||||
root["Date"] = format_datetime(datetime.now(UTC))
|
||||
root["Message-ID"] = make_msgid(domain=account.email.rsplit("@", 1)[-1])
|
||||
|
||||
alt = MIMEMultipart("alternative")
|
||||
alt.attach(MIMEText(text, "plain", "utf-8"))
|
||||
alt.attach(MIMEText(html, "html", "utf-8"))
|
||||
if ics is not None:
|
||||
cal = MIMEText(ics, "calendar", "utf-8")
|
||||
cal.set_param("method", ics_method)
|
||||
cal.set_param("component", "VEVENT")
|
||||
alt.attach(cal)
|
||||
root.attach(alt)
|
||||
|
||||
if ics is not None:
|
||||
att = MIMEApplication(ics.encode("utf-8"), _subtype="ics")
|
||||
att.add_header("Content-Disposition", "attachment", filename=ics_filename)
|
||||
root.attach(att)
|
||||
|
||||
return root.as_bytes()
|
||||
@@ -29,7 +29,9 @@ from app.models import User
|
||||
from app.outbox import service as outbox_service
|
||||
from app.plugins.actions import PluginActions, PluginMessages
|
||||
from app.plugins.db import plugin_session
|
||||
from app.plugins.http import PluginHttp
|
||||
from app.plugins.kv import PluginKvStore
|
||||
from app.plugins.mail import PluginMail
|
||||
from app.plugins.types import (
|
||||
Hook,
|
||||
JobFunc,
|
||||
@@ -40,6 +42,7 @@ from app.plugins.types import (
|
||||
Slot,
|
||||
UiManifest,
|
||||
)
|
||||
from app.plugins.vault import PluginVault
|
||||
from app.queue import enqueue_job
|
||||
|
||||
__all__ = [
|
||||
@@ -122,6 +125,11 @@ class PluginSdk:
|
||||
return outbox_service
|
||||
|
||||
# --- messages -----------------------------------------------------------
|
||||
@property
|
||||
def mail(self) -> PluginMail:
|
||||
"""Send an email from one of the user's own accounts (iMIP invites, …)."""
|
||||
return PluginMail()
|
||||
|
||||
@property
|
||||
def messages(self) -> PluginMessages:
|
||||
"""Read a user's message envelope (subject/sender/flags) for matching."""
|
||||
@@ -137,6 +145,19 @@ class PluginSdk:
|
||||
"""GET ``url`` through the §10.6 SSRF guard (blocks private IPs/oversize)."""
|
||||
return await guarded_get(url)
|
||||
|
||||
@property
|
||||
def http(self) -> PluginHttp:
|
||||
"""Multi-method SSRF-guarded HTTP (GET/PUT/DELETE/PROPFIND/REPORT) for
|
||||
CalDAV/CardDAV/ICS. Returns status + headers + body."""
|
||||
return PluginHttp()
|
||||
|
||||
# --- secret vault -------------------------------------------------------
|
||||
@property
|
||||
def vault(self) -> PluginVault:
|
||||
"""Envelope encrypt/decrypt for a plugin's own ``secret_ct`` columns
|
||||
(CalDAV/CardDAV credentials, tokens) — §10.2 at-rest protection."""
|
||||
return PluginVault()
|
||||
|
||||
|
||||
def sdk(name: str) -> PluginSdk:
|
||||
"""Return the SDK facade bound to plugin ``name`` (SPEC §11)."""
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
"""Secret encryption exposed to plugins (SPEC §10.2 vault).
|
||||
|
||||
Heavy plugins (calendar/contacts) store third-party credentials — CalDAV/CardDAV
|
||||
passwords, ICS tokens — in their own ``secret_ct bytea`` columns. They encrypt via
|
||||
this facade so those secrets are protected at rest with the same envelope scheme as
|
||||
core account credentials, without importing ``app.security`` directly.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from app.security.crypto import decrypt_secret, encrypt_secret
|
||||
|
||||
|
||||
class PluginVault:
|
||||
def encrypt(self, plaintext: bytes) -> bytes:
|
||||
"""Envelope-encrypt ``plaintext`` for storage in a ``secret_ct`` column."""
|
||||
return encrypt_secret(plaintext)
|
||||
|
||||
def decrypt(self, ciphertext: bytes) -> bytes:
|
||||
"""Reverse :meth:`encrypt`. Raises on a wrong/rotated master key."""
|
||||
return decrypt_secret(ciphertext)
|
||||
@@ -126,6 +126,32 @@ def test_inline_image_nested_in_related_is_extracted() -> None:
|
||||
assert parsed.has_attachments is False
|
||||
|
||||
|
||||
def test_attachment_with_content_id_is_a_real_attachment() -> None:
|
||||
# iMIP invites (e.g. Fastmail) send invite.ics as Content-Disposition: attachment
|
||||
# yet also give it a Content-ID. It must show as a downloadable chip, not be
|
||||
# hidden as an inline resource (regression: "no attachments" shown).
|
||||
from email.mime.multipart import MIMEMultipart
|
||||
from email.mime.text import MIMEText
|
||||
|
||||
root = MIMEMultipart("mixed")
|
||||
root["Subject"] = "invite"
|
||||
root["From"] = "org@example.com"
|
||||
root["To"] = "me@example.com"
|
||||
root["Message-ID"] = "<inv@x.com>"
|
||||
root.attach(MIMEText("body", "plain"))
|
||||
ics = MIMEText("BEGIN:VCALENDAR\nEND:VCALENDAR", "calendar")
|
||||
ics.add_header("Content-Disposition", "attachment", filename="invite.ics")
|
||||
ics.add_header("Content-ID", "<cal123@x>")
|
||||
root.attach(ics)
|
||||
|
||||
parsed = parse_message(root.as_bytes())
|
||||
assert len(parsed.attachments) == 1
|
||||
att = parsed.attachments[0]
|
||||
assert att.filename == "invite.ics"
|
||||
assert att.content_id is None # not treated as inline despite the Content-ID
|
||||
assert parsed.has_attachments is True
|
||||
|
||||
|
||||
def test_missing_message_id_returns_none() -> None:
|
||||
msg = EmailMessage()
|
||||
msg["Subject"] = "no id"
|
||||
|
||||
@@ -54,3 +54,35 @@ def test_javascript_uri_is_stripped() -> None:
|
||||
def test_sanitizer_version_reported() -> None:
|
||||
result = sanitize_html("<p>hi</p>", MID)
|
||||
assert result.sanitizer_v >= 1
|
||||
|
||||
|
||||
def test_style_block_and_classes_are_kept() -> None:
|
||||
# Mailers (e.g. Fastmail invites) put layout in a <style> block + classes.
|
||||
html = '<style>.banner{color:#333}</style><div class="banner">hi</div>'
|
||||
result = sanitize_html(html, MID)
|
||||
assert "<style" in result.html.lower()
|
||||
assert ".banner" in result.html
|
||||
assert 'class="banner"' in result.html
|
||||
|
||||
|
||||
def test_style_block_script_css_is_dropped() -> None:
|
||||
html = '<style>.x{width:expression(alert(1))}</style><p class="x">hi</p>'
|
||||
result = sanitize_html(html, MID)
|
||||
assert "expression(" not in result.html.lower()
|
||||
# the block is nuked but the element/class survive
|
||||
assert 'class="x"' in result.html
|
||||
|
||||
|
||||
def test_style_block_import_and_url_stripped_when_remote_blocked() -> None:
|
||||
html = "<style>@import url('http://evil/x.css'); .b{background:url(http://evil/p.gif)}</style>"
|
||||
result = sanitize_html(html, MID)
|
||||
assert "@import" not in result.html.lower()
|
||||
assert "evil" not in result.html.lower()
|
||||
assert result.has_remote_images
|
||||
|
||||
|
||||
def test_script_content_still_stripped_with_style_allowed() -> None:
|
||||
html = "<script>alert(1)</script><style>.a{color:red}</style>"
|
||||
result = sanitize_html(html, MID)
|
||||
assert "alert(1)" not in result.html
|
||||
assert ".a{color:red}" in result.html
|
||||
|
||||
@@ -0,0 +1,170 @@
|
||||
"""Calendar plugin A1 API: calendars/events CRUD + range expansion (SPEC §A).
|
||||
|
||||
Exercises the real HTTP surface: default-calendar bootstrap, event create/list with
|
||||
recurrence expansion, edit, delete, read-only rejection, and per-user isolation.
|
||||
Requires the calendar plugin installed + migrated.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import uuid
|
||||
from collections.abc import AsyncIterator
|
||||
|
||||
import httpx
|
||||
import pytest_asyncio
|
||||
from httpx import ASGITransport
|
||||
from sqlalchemy import delete, text
|
||||
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
|
||||
from sqlalchemy.pool import NullPool
|
||||
|
||||
from app.config import get_settings
|
||||
from app.identity.passwords import hash_password
|
||||
from app.identity.sessions import create_session
|
||||
from app.main import create_app
|
||||
from app.models import User
|
||||
|
||||
CAL = "/api/plugins/calendar"
|
||||
|
||||
|
||||
class _Ctx:
|
||||
user_id: uuid.UUID
|
||||
sm: async_sessionmaker # type: ignore[type-arg]
|
||||
client: httpx.AsyncClient
|
||||
client_b: httpx.AsyncClient
|
||||
|
||||
|
||||
@pytest_asyncio.fixture
|
||||
async def ctx() -> AsyncIterator[_Ctx]:
|
||||
engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
|
||||
sm = async_sessionmaker(engine, expire_on_commit=False)
|
||||
c = _Ctx()
|
||||
c.sm = sm
|
||||
ids: list[uuid.UUID] = []
|
||||
async with sm() as s:
|
||||
for _ in range(2):
|
||||
handle = f"cal{uuid.uuid4().hex[:8]}@test.local"
|
||||
u = User(handle=handle, password_hash=hash_password("pw"))
|
||||
s.add(u)
|
||||
await s.flush()
|
||||
ids.append(u.id)
|
||||
await s.commit()
|
||||
c.user_id = ids[0]
|
||||
transport = ASGITransport(app=create_app())
|
||||
|
||||
async def client(uid: uuid.UUID) -> httpx.AsyncClient:
|
||||
token = await create_session(uid, "pytest")
|
||||
return httpx.AsyncClient(
|
||||
transport=transport,
|
||||
base_url="http://testserver",
|
||||
cookies={"session": token, "csrf": "csrf"},
|
||||
headers={"X-CSRF": "csrf"},
|
||||
)
|
||||
|
||||
c.client = await client(ids[0])
|
||||
c.client_b = await client(ids[1])
|
||||
try:
|
||||
yield c
|
||||
finally:
|
||||
await c.client.aclose()
|
||||
await c.client_b.aclose()
|
||||
async with sm() as s: # cascade drops plg_calendar_* rows (user_id FK-less but scoped)
|
||||
await s.execute(
|
||||
text("DELETE FROM plg_calendar_calendars WHERE user_id = ANY(:ids)"),
|
||||
{"ids": [str(i) for i in ids]},
|
||||
)
|
||||
await s.execute(delete(User).where(User.id.in_(ids)))
|
||||
await s.commit()
|
||||
await engine.dispose()
|
||||
|
||||
|
||||
async def _events(
|
||||
client: httpx.AsyncClient,
|
||||
start: str = "2026-06-01T00:00:00Z",
|
||||
end: str = "2026-06-02T00:00:00Z",
|
||||
) -> list[dict[str, object]]:
|
||||
r = await client.get(f"{CAL}/events", params={"start": start, "end": end})
|
||||
return r.json()["events"]
|
||||
|
||||
|
||||
async def test_default_calendar_and_event_crud(ctx: _Ctx) -> None:
|
||||
# First calendars call bootstraps a default "Personal" calendar.
|
||||
cals = (await ctx.client.get(f"{CAL}/calendars")).json()
|
||||
assert [c["name"] for c in cals] == ["Personal"]
|
||||
cal_id = cals[0]["id"]
|
||||
|
||||
# Create a timed event and read it back in a range.
|
||||
r = await ctx.client.post(
|
||||
f"{CAL}/events",
|
||||
json={
|
||||
"calendar_id": cal_id,
|
||||
"summary": "Standup",
|
||||
"dtstart": "2026-06-01T09:00:00Z",
|
||||
"dtend": "2026-06-01T09:30:00Z",
|
||||
},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
event_id = r.json()["id"]
|
||||
|
||||
listing = await _events(ctx.client)
|
||||
assert len(listing) == 1
|
||||
assert listing[0]["summary"] == "Standup"
|
||||
assert listing[0]["color"] == "#3b82f6"
|
||||
|
||||
# Edit, then delete.
|
||||
patched = await ctx.client.patch(f"{CAL}/events/{event_id}", json={"summary": "Daily standup"})
|
||||
assert patched.status_code == 200
|
||||
again = await _events(ctx.client)
|
||||
assert again[0]["summary"] == "Daily standup"
|
||||
|
||||
assert (await ctx.client.delete(f"{CAL}/events/{event_id}")).status_code == 200
|
||||
empty = await _events(ctx.client)
|
||||
assert empty == []
|
||||
|
||||
|
||||
async def test_recurring_event_expands_in_range(ctx: _Ctx) -> None:
|
||||
cal_id = (await ctx.client.get(f"{CAL}/calendars")).json()[0]["id"]
|
||||
await ctx.client.post(
|
||||
f"{CAL}/events",
|
||||
json={
|
||||
"calendar_id": cal_id,
|
||||
"summary": "Weekly sync",
|
||||
"dtstart": "2026-06-01T14:00:00Z", # Monday
|
||||
"dtend": "2026-06-01T15:00:00Z",
|
||||
"rrule": "FREQ=WEEKLY;BYDAY=MO",
|
||||
},
|
||||
)
|
||||
# A 3-week window contains 3 Monday occurrences of one recurring event.
|
||||
listing = await _events(ctx.client, end="2026-06-22T00:00:00Z")
|
||||
assert len(listing) == 3
|
||||
assert all(i["recurring"] for i in listing)
|
||||
assert [i["start"][:10] for i in listing] == ["2026-06-01", "2026-06-08", "2026-06-15"]
|
||||
|
||||
|
||||
async def test_read_only_calendar_rejects_writes(ctx: _Ctx) -> None:
|
||||
cal_id = (await ctx.client.get(f"{CAL}/calendars")).json()[0]["id"]
|
||||
# Simulate an ICS subscription: flip the calendar read-only directly.
|
||||
async with ctx.sm() as s:
|
||||
await s.execute(
|
||||
text("UPDATE plg_calendar_calendars SET read_only = true WHERE id = :id"),
|
||||
{"id": cal_id},
|
||||
)
|
||||
await s.commit()
|
||||
r = await ctx.client.post(
|
||||
f"{CAL}/events",
|
||||
json={"calendar_id": cal_id, "summary": "nope", "dtstart": "2026-06-01T09:00:00Z"},
|
||||
)
|
||||
assert r.status_code == 403
|
||||
body = r.json()
|
||||
detail = body.get("error", {}).get("message") or body.get("detail")
|
||||
assert detail == "read_only_calendar"
|
||||
|
||||
|
||||
async def test_events_are_per_user_isolated(ctx: _Ctx) -> None:
|
||||
cal_id = (await ctx.client.get(f"{CAL}/calendars")).json()[0]["id"]
|
||||
await ctx.client.post(
|
||||
f"{CAL}/events",
|
||||
json={"calendar_id": cal_id, "summary": "Private", "dtstart": "2026-06-05T10:00:00Z"},
|
||||
)
|
||||
# User B has their own default calendar and sees none of A's events.
|
||||
b_events = await _events(ctx.client_b, end="2026-06-30T00:00:00Z")
|
||||
assert b_events == []
|
||||
@@ -0,0 +1,84 @@
|
||||
"""Calendar recurrence expansion across a DST boundary (SPEC §A.3, acceptance A.7.2)."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import UTC, datetime, timedelta
|
||||
from zoneinfo import ZoneInfo
|
||||
|
||||
from webmail_plugin_calendar.recurrence import expand_occurrences # type: ignore[import-not-found]
|
||||
|
||||
WARSAW = ZoneInfo("Europe/Warsaw")
|
||||
|
||||
|
||||
def _local(occ: list[tuple[datetime, datetime]]) -> dict[str, datetime]:
|
||||
# Map "YYYY-MM-DD" (Warsaw date) -> the UTC start of that occurrence.
|
||||
return {s.astimezone(WARSAW).date().isoformat(): s for s, _ in occ}
|
||||
|
||||
|
||||
def test_weekly_recurrence_keeps_local_time_across_dst() -> None:
|
||||
# Monday 2026-03-23 10:00 Europe/Warsaw == 09:00 UTC (UTC+1, before DST).
|
||||
# DST starts 2026-03-29, so from 03-30 the offset is UTC+2.
|
||||
dtstart = datetime(2026, 3, 23, 9, 0, tzinfo=UTC)
|
||||
occ = expand_occurrences(
|
||||
dtstart=dtstart,
|
||||
duration=timedelta(hours=1),
|
||||
rrule="FREQ=WEEKLY;BYDAY=MO",
|
||||
exdates=[],
|
||||
range_start=datetime(2026, 3, 1, tzinfo=UTC),
|
||||
range_end=datetime(2026, 4, 30, tzinfo=UTC),
|
||||
tz="Europe/Warsaw",
|
||||
)
|
||||
by_date = _local(occ)
|
||||
|
||||
# Every occurrence is at 10:00 local wall-clock, on both sides of the DST change.
|
||||
for start, _ in occ:
|
||||
assert start.astimezone(WARSAW).strftime("%H:%M") == "10:00"
|
||||
|
||||
# ...but the UTC offset moves across the boundary.
|
||||
assert by_date["2026-03-23"].hour == 9 # UTC+1
|
||||
assert by_date["2026-03-30"].hour == 8 # UTC+2 (DST)
|
||||
assert by_date["2026-04-06"].hour == 8
|
||||
|
||||
|
||||
def test_exdates_remove_instances() -> None:
|
||||
dtstart = datetime(2026, 3, 23, 9, 0, tzinfo=UTC)
|
||||
occ = expand_occurrences(
|
||||
dtstart=dtstart,
|
||||
duration=timedelta(hours=1),
|
||||
rrule="FREQ=WEEKLY;BYDAY=MO",
|
||||
# Exclude the 2026-03-30 occurrence (10:00 Warsaw == 08:00 UTC under DST).
|
||||
exdates=[datetime(2026, 3, 30, 8, 0, tzinfo=UTC)],
|
||||
range_start=datetime(2026, 3, 1, tzinfo=UTC),
|
||||
range_end=datetime(2026, 4, 30, tzinfo=UTC),
|
||||
tz="Europe/Warsaw",
|
||||
)
|
||||
dates = set(_local(occ))
|
||||
assert "2026-03-23" in dates
|
||||
assert "2026-03-30" not in dates # excluded
|
||||
assert "2026-04-06" in dates
|
||||
|
||||
|
||||
def test_single_event_no_rrule() -> None:
|
||||
dtstart = datetime(2026, 6, 1, 12, 0, tzinfo=UTC)
|
||||
occ = expand_occurrences(
|
||||
dtstart=dtstart,
|
||||
duration=timedelta(minutes=30),
|
||||
rrule=None,
|
||||
exdates=[],
|
||||
range_start=datetime(2026, 6, 1, tzinfo=UTC),
|
||||
range_end=datetime(2026, 6, 2, tzinfo=UTC),
|
||||
tz="UTC",
|
||||
)
|
||||
assert occ == [(dtstart, dtstart + timedelta(minutes=30))]
|
||||
|
||||
# Outside the window -> nothing.
|
||||
empty = expand_occurrences(
|
||||
dtstart=dtstart,
|
||||
duration=timedelta(minutes=30),
|
||||
rrule=None,
|
||||
exdates=[],
|
||||
range_start=datetime(2026, 7, 1, tzinfo=UTC),
|
||||
range_end=datetime(2026, 7, 2, tzinfo=UTC),
|
||||
tz="UTC",
|
||||
)
|
||||
assert empty == []
|
||||
@@ -0,0 +1,33 @@
|
||||
"""SDK security surface for heavy plugins: vault + multi-method guarded HTTP."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import pytest
|
||||
|
||||
from app.accounts.ssrf import SsrfError, guarded_request
|
||||
from app.plugins.sdk import sdk
|
||||
|
||||
|
||||
def test_vault_round_trips_secrets() -> None:
|
||||
vault = sdk("calendar").vault
|
||||
secret = b"caldav-app-password-123"
|
||||
blob = vault.encrypt(secret)
|
||||
assert blob != secret # encrypted at rest
|
||||
assert vault.decrypt(blob) == secret
|
||||
|
||||
|
||||
async def test_guarded_request_rejects_non_https() -> None:
|
||||
with pytest.raises(SsrfError, match="https"):
|
||||
await guarded_request("PROPFIND", "http://dav.example/cal/")
|
||||
|
||||
|
||||
async def test_guarded_request_rejects_private_host() -> None:
|
||||
# Resolves to a loopback/private address -> blocked before any connection.
|
||||
with pytest.raises(SsrfError, match="non-public|resolve"):
|
||||
await guarded_request("GET", "https://localhost/")
|
||||
|
||||
|
||||
def test_http_facade_exposes_dav_verbs() -> None:
|
||||
http = sdk("calendar").http
|
||||
for verb in ("request", "get", "put", "delete", "propfind", "report"):
|
||||
assert callable(getattr(http, verb))
|
||||
Reference in New Issue
Block a user