lukasandClaude Opus 4.8
8c634f7967
Calendar plugin (webmail_plugin_calendar, non-removable core plugin): - Local calendars/events CRUD with RLS isolation; recurrence expanded at query time (DST-correct), EXDATE + detached-override merge. - Calendar app bundle: month/week/day/3-day views, mini-month, event form (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient autocomplete, Jitsi video call), event popover with RSVP badges, resizable/ collapsible left panel + theme toggle, overlap layout. - iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML + text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token) records accepted/declined/tentative per attendee. - "This and following" edit + scoped delete (this / this-and-following), with a delete confirmation dialog for recurring events. Core: - Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations section; date order follows time format (en-GB vs en-US) across Mail. - Plugin SDK: mail (send from a user's account), vault (envelope encrypt), multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed PluginPage. Mail HTML rendering: - Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like, strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so already-indexed mail re-sanitizes on view. - Attachments: a Content-Disposition: attachment part is a real attachment even when it also carries a Content-ID (fixes hidden invite.ics). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.1 KiB
Python
34 lines
1.1 KiB
Python
"""SDK security surface for heavy plugins: vault + multi-method guarded HTTP."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from app.accounts.ssrf import SsrfError, guarded_request
|
|
from app.plugins.sdk import sdk
|
|
|
|
|
|
def test_vault_round_trips_secrets() -> None:
|
|
vault = sdk("calendar").vault
|
|
secret = b"caldav-app-password-123"
|
|
blob = vault.encrypt(secret)
|
|
assert blob != secret # encrypted at rest
|
|
assert vault.decrypt(blob) == secret
|
|
|
|
|
|
async def test_guarded_request_rejects_non_https() -> None:
|
|
with pytest.raises(SsrfError, match="https"):
|
|
await guarded_request("PROPFIND", "http://dav.example/cal/")
|
|
|
|
|
|
async def test_guarded_request_rejects_private_host() -> None:
|
|
# Resolves to a loopback/private address -> blocked before any connection.
|
|
with pytest.raises(SsrfError, match="non-public|resolve"):
|
|
await guarded_request("GET", "https://localhost/")
|
|
|
|
|
|
def test_http_facade_exposes_dav_verbs() -> None:
|
|
http = sdk("calendar").http
|
|
for verb in ("request", "get", "put", "delete", "propfind", "report"):
|
|
assert callable(getattr(http, verb))
|