From 092604694a00ba873110774cf2256b480799fa14 Mon Sep 17 00:00:00 2001
From: Lennart <18233294+lennart-k@users.noreply.github.com>
Date: Mon, 17 Nov 2025 01:21:20 +0100
Subject: [PATCH] multiget: percent-decode hrefs

---
 .../src/calendar/methods/report/calendar_multiget.rs      | 8 +++++---
 .../addressbook/methods/report/addressbook_multiget.rs    | 8 +++++---
 crates/store_sqlite/src/calendar_store.rs                 | 1 +
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/crates/caldav/src/calendar/methods/report/calendar_multiget.rs b/crates/caldav/src/calendar/methods/report/calendar_multiget.rs
index ae5277a..2cf61ff 100644
--- a/crates/caldav/src/calendar/methods/report/calendar_multiget.rs
+++ b/crates/caldav/src/calendar/methods/report/calendar_multiget.rs
@@ -26,16 +26,18 @@ pub async fn get_objects_calendar_multiget<C: CalendarStore>(
     let mut not_found = vec![];
 
     for href in &cal_query.href {
-        if let Some(filename) = href.strip_prefix(path) {
+        if let Ok(href) = percent_encoding::percent_decode_str(href).decode_utf8()
+            && let Some(filename) = href.strip_prefix(path)
+        {
             let filename = filename.trim_start_matches('/');
             if let Some(object_id) = filename.strip_suffix(".ics") {
                 match store.get_object(principal, cal_id, object_id, false).await {
                     Ok(object) => result.push(object),
-                    Err(rustical_store::Error::NotFound) => not_found.push(href.to_owned()),
+                    Err(rustical_store::Error::NotFound) => not_found.push(href.to_string()),
                     Err(err) => return Err(err.into()),
                 }
             } else {
-                not_found.push(href.to_owned());
+                not_found.push(href.to_string());
             }
         } else {
             not_found.push(href.to_owned());
diff --git a/crates/carddav/src/addressbook/methods/report/addressbook_multiget.rs b/crates/carddav/src/addressbook/methods/report/addressbook_multiget.rs
index 16e46ce..53fff13 100644
--- a/crates/carddav/src/addressbook/methods/report/addressbook_multiget.rs
+++ b/crates/carddav/src/addressbook/methods/report/addressbook_multiget.rs
@@ -34,7 +34,9 @@ pub async fn get_objects_addressbook_multiget<AS: AddressbookStore>(
     let mut not_found = vec![];
 
     for href in &addressbook_multiget.href {
-        if let Some(filename) = href.strip_prefix(path) {
+        if let Ok(href) = percent_encoding::percent_decode_str(href).decode_utf8()
+            && let Some(filename) = href.strip_prefix(path)
+        {
             let filename = filename.trim_start_matches('/');
             if let Some(object_id) = filename.strip_suffix(".vcf") {
                 match store
@@ -42,11 +44,11 @@ pub async fn get_objects_addressbook_multiget<AS: AddressbookStore>(
                     .await
                 {
                     Ok(object) => result.push(object),
-                    Err(rustical_store::Error::NotFound) => not_found.push(href.to_owned()),
+                    Err(rustical_store::Error::NotFound) => not_found.push(href.to_string()),
                     Err(err) => return Err(err.into()),
                 }
             } else {
-                not_found.push(href.to_owned());
+                not_found.push(href.to_string());
             }
         } else {
             not_found.push(href.to_owned());
diff --git a/crates/store_sqlite/src/calendar_store.rs b/crates/store_sqlite/src/calendar_store.rs
index 5c47d84..0e3e61f 100644
--- a/crates/store_sqlite/src/calendar_store.rs
+++ b/crates/store_sqlite/src/calendar_store.rs
@@ -795,6 +795,7 @@ impl CalendarStore for SqliteCalendarStore {
 }
 
 // Logs an operation to the events
+// TODO: Log multiple updates
 async fn log_object_operation(
     tx: &mut Transaction<'_, Sqlite>,
     principal: &str,