version 0.4.12

.sqlx/query-2f043f62a7c0eae1023e319f0bc8f35dfdcf6a8247e03b1de3e2cabb2d3ab8ae.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n            REPLACE INTO principals\n            (id, displayname, principal_type, password_hash)\n            VALUES (?, ?, ?, ?)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 4
-    },
-    "nullable": []
-  },
-  "hash": "2f043f62a7c0eae1023e319f0bc8f35dfdcf6a8247e03b1de3e2cabb2d3ab8ae"
-}

.sqlx/query-5c09c2a3c052188435409d4ff076575394e625dd19f00dea2d4c71a9f34a5952.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n            INSERT INTO principals\n            (id, displayname, principal_type, password_hash) VALUES (?, ?, ?, ?)\n            ON CONFLICT(id) DO UPDATE SET\n                (displayname, principal_type, password_hash)\n                = (excluded.displayname, excluded.principal_type, excluded.password_hash)\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 4
+    },
+    "nullable": []
+  },
+  "hash": "5c09c2a3c052188435409d4ff076575394e625dd19f00dea2d4c71a9f34a5952"
+}

.sqlx/query-660833e0505d3bbcd6dd736cce06b1bf14263d0e0e87b27d89d376d422e4e474.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT length(vcf) AS 'length!: u64', deleted_at AS 'deleted!: bool' FROM addressobjects WHERE principal = ? AND addressbook_id = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "length!: u64",
+        "ordinal": 0,
+        "type_info": "Null"
+      },
+      {
+        "name": "deleted!: bool",
+        "ordinal": 1,
+        "type_info": "Datetime"
+      }
+    ],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": [
+      null,
+      true
+    ]
+  },
+  "hash": "660833e0505d3bbcd6dd736cce06b1bf14263d0e0e87b27d89d376d422e4e474"
+}

.sqlx/query-d9f14260a46a7ccd137d462c35d350a7fe338a074131776596c5d803fcda1f48.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT length(ics) AS 'length!: u64', deleted_at AS 'deleted!: bool' FROM calendarobjects WHERE principal = ? AND cal_id = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "length!: u64",
+        "ordinal": 0,
+        "type_info": "Null"
+      },
+      {
+        "name": "deleted!: bool",
+        "ordinal": 1,
+        "type_info": "Datetime"
+      }
+    ],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": [
+      null,
+      true
+    ]
+  },
+  "hash": "d9f14260a46a7ccd137d462c35d350a7fe338a074131776596c5d803fcda1f48"
+}

Cargo.lock

@@ -2999,7 +2999,7 @@ dependencies = [
 
 [[package]]
 name = "rustical"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "anyhow",
  "argon2",
@@ -3042,7 +3042,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_caldav"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-std",
  "async-trait",
@@ -3080,7 +3080,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_carddav"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-trait",
  "axum",
@@ -3112,7 +3112,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_dav"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-trait",
  "axum",
@@ -3137,7 +3137,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_dav_push"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-trait",
  "axum",
@@ -3163,7 +3163,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_frontend"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "askama",
  "askama_web",
@@ -3196,7 +3196,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_ical"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "axum",
  "chrono",
@@ -3214,7 +3214,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_oidc"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-trait",
  "axum",
@@ -3229,7 +3229,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_store"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3263,7 +3263,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_store_sqlite"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "async-trait",
  "chrono",
@@ -3284,7 +3284,7 @@ dependencies = [
 
 [[package]]
 name = "rustical_xml"
-version = "0.4.7"
+version = "0.4.12"
 dependencies = [
  "quick-xml",
  "thiserror 2.0.12",

Cargo.toml

@@ -2,7 +2,7 @@
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.4.7"
+version = "0.4.12"
 edition = "2024"
 description = "A CalDAV server"
 repository = "https://github.com/lennart-k/rustical"

crates/caldav/src/calendar/methods/get.rs

@@ -4,7 +4,7 @@ use axum::body::Body;
 use axum::extract::State;
 use axum::{extract::Path, response::Response};
 use headers::{ContentType, HeaderMapExt};
-use http::{HeaderValue, StatusCode, header};
+use http::{HeaderValue, Method, StatusCode, header};
 use ical::generator::{Emitter, IcalCalendarBuilder};
 use ical::property::Property;
 use percent_encoding::{CONTROLS, utf8_percent_encode};
@@ -19,6 +19,7 @@ pub async fn route_get<C: CalendarStore, S: SubscriptionStore>(
     Path((principal, calendar_id)): Path<(String, String)>,
     State(CalendarResourceService { cal_store, .. }): State<CalendarResourceService<C, S>>,
     user: Principal,
+    method: Method,
 ) -> Result<Response, Error> {
     if !user.is_principal(&principal) {
         return Err(crate::Error::Unauthorized);
@@ -96,5 +97,9 @@ pub async fn route_get<C: CalendarStore, S: SubscriptionStore>(
         ))
         .unwrap(),
     );
-    Ok(resp.body(Body::new(ical_calendar.generate())).unwrap())
+    if matches!(method, Method::HEAD) {
+        Ok(resp.body(Body::empty()).unwrap())
+    } else {
+        Ok(resp.body(Body::new(ical_calendar.generate())).unwrap())
+    }
 }

crates/caldav/src/calendar_object/methods.rs

@@ -6,7 +6,7 @@ use axum::extract::{Path, State};
 use axum::response::{IntoResponse, Response};
 use axum_extra::TypedHeader;
 use headers::{ContentType, ETag, HeaderMapExt, IfNoneMatch};
-use http::{HeaderMap, StatusCode};
+use http::{HeaderMap, Method, StatusCode};
 use rustical_ical::CalendarObject;
 use rustical_store::CalendarStore;
 use rustical_store::auth::Principal;
@@ -22,6 +22,7 @@ pub async fn get_event<C: CalendarStore>(
     }): Path<CalendarObjectPathComponents>,
     State(CalendarObjectResourceService { cal_store }): State<CalendarObjectResourceService<C>>,
     user: Principal,
+    method: Method,
 ) -> Result<Response, Error> {
     if !user.is_principal(&principal) {
         return Err(crate::Error::Unauthorized);
@@ -42,7 +43,11 @@ pub async fn get_event<C: CalendarStore>(
     let hdrs = resp.headers_mut().unwrap();
     hdrs.typed_insert(ETag::from_str(&event.get_etag()).unwrap());
     hdrs.typed_insert(ContentType::from_str("text/calendar").unwrap());
-    Ok(resp.body(Body::new(event.get_ics().to_owned())).unwrap())
+    if matches!(method, Method::HEAD) {
+        Ok(resp.body(Body::empty()).unwrap())
+    } else {
+        Ok(resp.body(Body::new(event.get_ics().to_owned())).unwrap())
+    }
 }
 
 #[instrument(skip(cal_store))]

crates/carddav/src/address_object/methods.rs

@@ -7,6 +7,7 @@ use axum::extract::{Path, State};
 use axum::response::{IntoResponse, Response};
 use axum_extra::TypedHeader;
 use axum_extra::headers::{ContentType, ETag, HeaderMapExt, IfNoneMatch};
+use http::Method;
 use http::{HeaderMap, StatusCode};
 use rustical_dav::privileges::UserPrivilege;
 use rustical_dav::resource::Resource;
@@ -25,6 +26,7 @@ pub async fn get_object<AS: AddressbookStore>(
     }): Path<AddressObjectPathComponents>,
     State(AddressObjectResourceService { addr_store }): State<AddressObjectResourceService<AS>>,
     user: Principal,
+    method: Method,
 ) -> Result<Response, Error> {
     if !user.is_principal(&principal) {
         return Err(Error::Unauthorized);
@@ -49,7 +51,11 @@ pub async fn get_object<AS: AddressbookStore>(
     let hdrs = resp.headers_mut().unwrap();
     hdrs.typed_insert(ETag::from_str(&object.get_etag()).unwrap());
     hdrs.typed_insert(ContentType::from_str("text/vcard").unwrap());
-    Ok(resp.body(Body::new(object.get_vcf().to_owned())).unwrap())
+    if matches!(method, Method::HEAD) {
+        Ok(resp.body(Body::empty()).unwrap())
+    } else {
+        Ok(resp.body(Body::new(object.get_vcf().to_owned())).unwrap())
+    }
 }
 
 #[instrument(skip(addr_store, body))]

crates/carddav/src/addressbook/methods/get.rs

@@ -5,7 +5,7 @@ use axum::body::Body;
 use axum::extract::{Path, State};
 use axum::response::Response;
 use axum_extra::headers::{ContentType, HeaderMapExt};
-use http::{HeaderValue, StatusCode, header};
+use http::{HeaderValue, Method, StatusCode, header};
 use percent_encoding::{CONTROLS, utf8_percent_encode};
 use rustical_dav::privileges::UserPrivilege;
 use rustical_dav::resource::Resource;
@@ -20,6 +20,7 @@ pub async fn route_get<AS: AddressbookStore, S: SubscriptionStore>(
     Path((principal, addressbook_id)): Path<(String, String)>,
     State(AddressbookResourceService { addr_store, .. }): State<AddressbookResourceService<AS, S>>,
     user: Principal,
+    method: Method,
 ) -> Result<Response, Error> {
     if !user.is_principal(&principal) {
         return Err(Error::Unauthorized);
@@ -55,5 +56,9 @@ pub async fn route_get<AS: AddressbookStore, S: SubscriptionStore>(
         ))
         .unwrap(),
     );
-    Ok(resp.body(Body::new(vcf)).unwrap())
+    if matches!(method, Method::HEAD) {
+        Ok(resp.body(Body::empty()).unwrap())
+    } else {
+        Ok(resp.body(Body::new(vcf)).unwrap())
+    }
 }

crates/dav/src/privileges.rs

@@ -16,12 +16,12 @@ pub enum UserPrivilege {
 }
 
 impl XmlSerialize for UserPrivilegeSet {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         #[derive(XmlSerialize)]
         pub struct FakeUserPrivilegeSet {
@@ -35,7 +35,6 @@ impl XmlSerialize for UserPrivilegeSet {
         .serialize(ns, tag, namespaces, writer)
     }
 
-    #[allow(refining_impl_trait)]
     fn attributes<'a>(&self) -> Option<Vec<quick_xml::events::attributes::Attribute<'a>>> {
         None
     }

crates/dav/src/resource/axum_methods.rs

@@ -18,11 +18,6 @@ pub trait AxumMethods: Sized + Send + Sync + 'static {
         None
     }
 
-    #[inline]
-    fn head() -> Option<MethodFunction<Self>> {
-        None
-    }
-
     #[inline]
     fn post() -> Option<MethodFunction<Self>> {
         None
@@ -58,8 +53,6 @@ pub trait AxumMethods: Sized + Send + Sync + 'static {
         }
         if Self::get().is_some() {
             allow.push(Method::GET);
-        }
-        if Self::head().is_some() {
             allow.push(Method::HEAD);
         }
         if Self::post().is_some() {

crates/dav/src/resource/axum_service.rs

@@ -72,16 +72,11 @@ where
                     return svc(self.resource_service.clone(), req);
                 }
             }
-            "GET" => {
+            "GET" | "HEAD" => {
                 if let Some(svc) = RS::get() {
                     return svc(self.resource_service.clone(), req);
                 }
             }
-            "HEAD" => {
-                if let Some(svc) = RS::head() {
-                    return svc(self.resource_service.clone(), req);
-                }
-            }
             "POST" => {
                 if let Some(svc) = RS::post() {
                     return svc(self.resource_service.clone(), req);

crates/dav/src/resource/methods/propfind.rs

@@ -77,6 +77,7 @@ pub(crate) async fn route_propfind<R: ResourceService>(
 
     let mut member_responses = Vec::new();
     if depth != &Depth::Zero {
+        // TODO: authorization check for member resources
         for member in resource_service.get_members(path_components).await? {
             member_responses.push(member.propfind(
                 &format!("{}/{}", path.trim_end_matches('/'), member.get_name()),

crates/dav/src/xml/multistatus.rs

@@ -19,12 +19,12 @@ pub struct PropstatElement<PropType: XmlSerialize> {
     pub status: StatusCode,
 }
 
-fn xml_serialize_status<W: ::std::io::Write>(
+fn xml_serialize_status(
     status: &StatusCode,
     ns: Option<Namespace>,
     tag: Option<&[u8]>,
     namespaces: &HashMap<Namespace, &[u8]>,
-    writer: &mut quick_xml::Writer<W>,
+    writer: &mut quick_xml::Writer<&mut Vec<u8>>,
 ) -> std::io::Result<()> {
     XmlSerialize::serialize(&format!("HTTP/1.1 {}", status), ns, tag, namespaces, writer)
 }
@@ -49,12 +49,12 @@ pub struct ResponseElement<PropstatType: XmlSerialize> {
     pub propstat: Vec<PropstatWrapper<PropstatType>>,
 }
 
-fn xml_serialize_optional_status<W: ::std::io::Write>(
+fn xml_serialize_optional_status(
     val: &Option<StatusCode>,
     ns: Option<Namespace>,
     tag: Option<&[u8]>,
     namespaces: &HashMap<Namespace, &[u8]>,
-    writer: &mut quick_xml::Writer<W>,
+    writer: &mut quick_xml::Writer<&mut Vec<u8>>,
 ) -> std::io::Result<()> {
     XmlSerialize::serialize(
         &val.map(|status| format!("HTTP/1.1 {}", status)),

crates/dav/src/xml/tag_list.rs

@@ -10,12 +10,12 @@ use std::collections::HashMap;
 pub struct TagList(Vec<(Option<NamespaceOwned>, String)>);
 
 impl XmlSerialize for TagList {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         let prefix = ns
             .map(|ns| namespaces.get(&ns))
@@ -57,7 +57,6 @@ impl XmlSerialize for TagList {
         Ok(())
     }
 
-    #[allow(refining_impl_trait)]
     fn attributes<'a>(&self) -> Option<Vec<quick_xml::events::attributes::Attribute<'a>>> {
         None
     }

crates/frontend/js-components/lib/create-addressbook-form.ts

@@ -2,6 +2,7 @@ import { html, LitElement } from "lit";
 import { customElement, property } from "lit/decorators.js";
 import { Ref, createRef, ref } from 'lit/directives/ref.js';
 import { createClient } from "webdav";
+import { escapeXml } from ".";
 
 @customElement("create-addressbook-form")
 export class CreateAddressbookForm extends LitElement {
@@ -17,13 +18,15 @@ export class CreateAddressbookForm extends LitElement {
   client = createClient("/carddav")
 
   @property()
-  user: String = ''
+  user: string = ''
   @property()
-  addr_id: String = ''
+  principal: string = ''
   @property()
-  displayname: String = ''
+  addr_id: string = ''
   @property()
-  description: String = ''
+  displayname: string = ''
+  @property()
+  description: string = ''
 
   dialog: Ref<HTMLDialogElement> = createRef()
   form: Ref<HTMLFormElement> = createRef()
@@ -34,6 +37,16 @@ export class CreateAddressbookForm extends LitElement {
       <dialog ${ref(this.dialog)}>
         <h3>Create addressbook</h3>
         <form @submit=${this.submit} ${ref(this.form)}>
+          <label>
+            principal (for group addressbooks)
+            <select name="principal" value=${this.user} @change=${e => this.principal = e.target.value}>
+              <option value=${this.user}>${this.user}</option>
+              ${window.rusticalUser.memberships.map(membership => html`
+                <option value=${membership}>${membership}</option>
+              `)}
+            </select>
+          </label>
+          <br>
           <label>
             id
             <input type="text" name="id" @change=${e => this.addr_id = e.target.value} />
@@ -68,13 +81,13 @@ export class CreateAddressbookForm extends LitElement {
       return
     }
     // TODO: Escape user input: There's not really a security risk here but would be nicer
-    await this.client.createDirectory(`/principal/${this.user}/${this.addr_id}`, {
+    await this.client.createDirectory(`/principal/${this.principal || this.user}/${this.addr_id}`, {
       data: `
       <mkcol xmlns="DAV:" xmlns:CARD="urn:ietf:params:xml:ns:carddav">
         <set>
           <prop>
-            <displayname>${this.displayname}</displayname>
+            <displayname>${escapeXml(this.displayname)}</displayname>
-            ${this.description ? `<CARD:addressbook-description>${this.description}</CARD:addressbook-description>` : ''}
+            ${this.description ? `<CARD:addressbook-description>${escapeXml(this.description)}</CARD:addressbook-description>` : ''}
           </prop>
         </set>
       </mkcol>

crates/frontend/js-components/lib/create-calendar-form.ts

@@ -2,6 +2,7 @@ import { html, LitElement } from "lit";
 import { customElement, property } from "lit/decorators.js";
 import { Ref, createRef, ref } from 'lit/directives/ref.js';
 import { createClient } from "webdav";
+import { escapeXml } from ".";
 
 @customElement("create-calendar-form")
 export class CreateCalendarForm extends LitElement {
@@ -16,17 +17,21 @@ export class CreateCalendarForm extends LitElement {
   client = createClient("/caldav")
 
   @property()
-  user: String = ''
+  user: string = ''
   @property()
-  cal_id: String = ''
+  principal: string = ''
   @property()
-  displayname: String = ''
+  cal_id: string = ''
   @property()
-  description: String = ''
+  displayname: string = ''
   @property()
-  color: String = ''
+  description: string = ''
   @property()
-  subscriptionUrl: String = ''
+  color: string = ''
+  @property()
+  isSubscription: boolean = false
+  @property()
+  subscriptionUrl: string = ''
   @property()
   components: Set<"VEVENT" | "VTODO" | "VJOURNAL"> = new Set()
 
@@ -40,6 +45,16 @@ export class CreateCalendarForm extends LitElement {
       <dialog ${ref(this.dialog)}>
         <h3>Create calendar</h3>
         <form @submit=${this.submit} ${ref(this.form)}>
+          <label>
+            principal (for group calendars)
+            <select name="principal" value=${this.user} @change=${e => this.principal = e.target.value}>
+              <option value=${this.user}>${this.user}</option>
+              ${window.rusticalUser.memberships.map(membership => html`
+                <option value=${membership}>${membership}</option>
+              `)}
+            </select>
+          </label>
+          <br>
           <label>
             id
             <input type="text" name="id" @change=${e => this.cal_id = e.target.value} />
@@ -60,16 +75,26 @@ export class CreateCalendarForm extends LitElement {
             <input type="color" name="color"  @change=${e => this.color = e.target.value} />
           </label>
           <br>
+          <br>
           <label>
-            Subscription URL
+            Calendar is subscription to external calendar
-            <input type="text" name="subscription_url" @change=${e => this.subscriptionUrl = e.target.value}  />
+            <input type="checkbox" name="is_subscription" @change=${e => this.isSubscription = e.target.checked}  />
           </label>
           <br>
+          ${this.isSubscription ? html`
+            <label>
+              Subscription URL
+              <input type="text" name="subscription_url" @change=${e => this.subscriptionUrl = e.target.value}  />
+            </label>
+            <br>
+          `: html``}
+          <br>
           ${["VEVENT", "VTODO", "VJOURNAL"].map(comp => html`
             <label>
               Support ${comp}
               <input type="checkbox" value=${comp} @change=${e => e.target.checked ? this.components.add(e.target.value) : this.components.delete(e.target.value)} />
             </label>
+            <br>
           `)}
           <br>
           <button type="submit">Create</button>
@@ -94,17 +119,17 @@ export class CreateCalendarForm extends LitElement {
       alert("No calendar components selected")
       return
     }
-    await this.client.createDirectory(`/principal/${this.user}/${this.cal_id}`, {
+    await this.client.createDirectory(`/principal/${this.principal || this.user}/${this.cal_id}`, {
       data: `
       <mkcol xmlns="DAV:" xmlns:CAL="urn:ietf:params:xml:ns:caldav" xmlns:CS="http://calendarserver.org/ns/" xmlns:ICAL="http://apple.com/ns/ical/">
         <set>
           <prop>
-            <displayname>${this.displayname}</displayname>
+            <displayname>${escapeXml(this.displayname)}</displayname>
-            ${this.description ? `<CAL:calendar-description>${this.description}</CAL:calendar-description>` : ''}
+            ${this.description ? `<CAL:calendar-description>${escapeXml(this.description)}</CAL:calendar-description>` : ''}
-            ${this.color ? `<ICAL:calendar-color>${this.color}</ICAL:calendar-color>` : ''}
+            ${this.color ? `<ICAL:calendar-color>${escapeXml(this.color)}</ICAL:calendar-color>` : ''}
-            ${this.subscriptionUrl ? `<CS:source><href>${this.subscriptionUrl}</href></CS:source>` : ''}
+            ${(this.isSubscription && this.subscriptionUrl) ? `<CS:source><href>${escapeXml(this.subscriptionUrl)}</href></CS:source>` : ''}
             <CAL:supported-calendar-component-set>
-              ${Array.from(this.components.keys()).map(comp => `<CAL:comp name="${comp}" />`).join('\n')}
+              ${Array.from(this.components.keys()).map(comp => `<CAL:comp name="${escapeXml(comp)}" />`).join('\n')}
             </CAL:supported-calendar-component-set>
           </prop>
         </set>

crates/frontend/js-components/lib/delete-button.ts

@@ -1,6 +1,5 @@
 import { html, LitElement } from "lit";
 import { customElement, property } from "lit/decorators.js";
-import { createClient } from "webdav";
 
 @customElement("delete-button")
 export class DeleteButton extends LitElement {

crates/frontend/js-components/lib/global.d.ts

@@ -0,0 +1,9 @@
+interface Window {
+  rusticalUser: {
+    id: String,
+    displayname: String | null,
+    memberships: Array<String>,
+    principal_type: "individual" | "group" | "room" | String
+  }
+}
+

crates/frontend/js-components/lib/index.ts

@@ -0,0 +1,7 @@
+export function escapeXml(unsafe: string): string {
+  return unsafe.replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;')
+}

crates/frontend/public/assets/js/create-addressbook-form.mjs

@@ -1,6 +1,6 @@
 import { i, x } from "./lit-z6_uA4GX.mjs";
 import { n as n$1, t } from "./property-D0NJdseG.mjs";
-import { e, n } from "./ref-CPp9J0V5.mjs";
+import { e, n, a as escapeXml } from "./index-b86iLJlP.mjs";
 import { a as an } from "./webdav-D0R7xCzX.mjs";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -17,6 +17,7 @@ let CreateAddressbookForm = class extends i {
     super();
     this.client = an("/carddav");
     this.user = "";
+    this.principal = "";
     this.addr_id = "";
     this.displayname = "";
     this.description = "";
@@ -32,6 +33,16 @@ let CreateAddressbookForm = class extends i {
       <dialog ${n(this.dialog)}>
         <h3>Create addressbook</h3>
         <form @submit=${this.submit} ${n(this.form)}>
+          <label>
+            principal (for group addressbooks)
+            <select name="principal" value=${this.user} @change=${(e2) => this.principal = e2.target.value}>
+              <option value=${this.user}>${this.user}</option>
+              ${window.rusticalUser.memberships.map((membership) => x`
+                <option value=${membership}>${membership}</option>
+              `)}
+            </select>
+          </label>
+          <br>
           <label>
             id
             <input type="text" name="id" @change=${(e2) => this.addr_id = e2.target.value} />
@@ -68,13 +79,13 @@ let CreateAddressbookForm = class extends i {
       alert("Empty displayname");
       return;
     }
-    await this.client.createDirectory(`/principal/${this.user}/${this.addr_id}`, {
+    await this.client.createDirectory(`/principal/${this.principal || this.user}/${this.addr_id}`, {
       data: `
       <mkcol xmlns="DAV:" xmlns:CARD="urn:ietf:params:xml:ns:carddav">
         <set>
           <prop>
-            <displayname>${this.displayname}</displayname>
+            <displayname>${escapeXml(this.displayname)}</displayname>
-            ${this.description ? `<CARD:addressbook-description>${this.description}</CARD:addressbook-description>` : ""}
+            ${this.description ? `<CARD:addressbook-description>${escapeXml(this.description)}</CARD:addressbook-description>` : ""}
           </prop>
         </set>
       </mkcol>
@@ -87,6 +98,9 @@ let CreateAddressbookForm = class extends i {
 __decorateClass([
   n$1()
 ], CreateAddressbookForm.prototype, "user", 2);
+__decorateClass([
+  n$1()
+], CreateAddressbookForm.prototype, "principal", 2);
 __decorateClass([
   n$1()
 ], CreateAddressbookForm.prototype, "addr_id", 2);

crates/frontend/public/assets/js/create-calendar-form.mjs

@@ -1,6 +1,6 @@
 import { i, x } from "./lit-z6_uA4GX.mjs";
 import { n as n$1, t } from "./property-D0NJdseG.mjs";
-import { e, n } from "./ref-CPp9J0V5.mjs";
+import { e, n, a as escapeXml } from "./index-b86iLJlP.mjs";
 import { a as an } from "./webdav-D0R7xCzX.mjs";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -17,10 +17,12 @@ let CreateCalendarForm = class extends i {
     super();
     this.client = an("/caldav");
     this.user = "";
+    this.principal = "";
     this.cal_id = "";
     this.displayname = "";
     this.description = "";
     this.color = "";
+    this.isSubscription = false;
     this.subscriptionUrl = "";
     this.components = /* @__PURE__ */ new Set();
     this.dialog = e();
@@ -35,6 +37,16 @@ let CreateCalendarForm = class extends i {
       <dialog ${n(this.dialog)}>
         <h3>Create calendar</h3>
         <form @submit=${this.submit} ${n(this.form)}>
+          <label>
+            principal (for group calendars)
+            <select name="principal" value=${this.user} @change=${(e2) => this.principal = e2.target.value}>
+              <option value=${this.user}>${this.user}</option>
+              ${window.rusticalUser.memberships.map((membership) => x`
+                <option value=${membership}>${membership}</option>
+              `)}
+            </select>
+          </label>
+          <br>
           <label>
             id
             <input type="text" name="id" @change=${(e2) => this.cal_id = e2.target.value} />
@@ -55,16 +67,26 @@ let CreateCalendarForm = class extends i {
             <input type="color" name="color"  @change=${(e2) => this.color = e2.target.value} />
           </label>
           <br>
+          <br>
           <label>
-            Subscription URL
+            Calendar is subscription to external calendar
-            <input type="text" name="subscription_url" @change=${(e2) => this.subscriptionUrl = e2.target.value}  />
+            <input type="checkbox" name="is_subscription" @change=${(e2) => this.isSubscription = e2.target.checked}  />
           </label>
           <br>
+          ${this.isSubscription ? x`
+            <label>
+              Subscription URL
+              <input type="text" name="subscription_url" @change=${(e2) => this.subscriptionUrl = e2.target.value}  />
+            </label>
+            <br>
+          ` : x``}
+          <br>
           ${["VEVENT", "VTODO", "VJOURNAL"].map((comp) => x`
             <label>
               Support ${comp}
               <input type="checkbox" value=${comp} @change=${(e2) => e2.target.checked ? this.components.add(e2.target.value) : this.components.delete(e2.target.value)} />
             </label>
+            <br>
           `)}
           <br>
           <button type="submit">Create</button>
@@ -92,17 +114,17 @@ let CreateCalendarForm = class extends i {
       alert("No calendar components selected");
       return;
     }
-    await this.client.createDirectory(`/principal/${this.user}/${this.cal_id}`, {
+    await this.client.createDirectory(`/principal/${this.principal || this.user}/${this.cal_id}`, {
       data: `
       <mkcol xmlns="DAV:" xmlns:CAL="urn:ietf:params:xml:ns:caldav" xmlns:CS="http://calendarserver.org/ns/" xmlns:ICAL="http://apple.com/ns/ical/">
         <set>
           <prop>
-            <displayname>${this.displayname}</displayname>
+            <displayname>${escapeXml(this.displayname)}</displayname>
-            ${this.description ? `<CAL:calendar-description>${this.description}</CAL:calendar-description>` : ""}
+            ${this.description ? `<CAL:calendar-description>${escapeXml(this.description)}</CAL:calendar-description>` : ""}
-            ${this.color ? `<ICAL:calendar-color>${this.color}</ICAL:calendar-color>` : ""}
+            ${this.color ? `<ICAL:calendar-color>${escapeXml(this.color)}</ICAL:calendar-color>` : ""}
-            ${this.subscriptionUrl ? `<CS:source><href>${this.subscriptionUrl}</href></CS:source>` : ""}
+            ${this.isSubscription && this.subscriptionUrl ? `<CS:source><href>${escapeXml(this.subscriptionUrl)}</href></CS:source>` : ""}
             <CAL:supported-calendar-component-set>
-              ${Array.from(this.components.keys()).map((comp) => `<CAL:comp name="${comp}" />`).join("\n")}
+              ${Array.from(this.components.keys()).map((comp) => `<CAL:comp name="${escapeXml(comp)}" />`).join("\n")}
             </CAL:supported-calendar-component-set>
           </prop>
         </set>
@@ -116,6 +138,9 @@ let CreateCalendarForm = class extends i {
 __decorateClass([
   n$1()
 ], CreateCalendarForm.prototype, "user", 2);
+__decorateClass([
+  n$1()
+], CreateCalendarForm.prototype, "principal", 2);
 __decorateClass([
   n$1()
 ], CreateCalendarForm.prototype, "cal_id", 2);
@@ -128,6 +153,9 @@ __decorateClass([
 __decorateClass([
   n$1()
 ], CreateCalendarForm.prototype, "color", 2);
+__decorateClass([
+  n$1()
+], CreateCalendarForm.prototype, "isSubscription", 2);
 __decorateClass([
   n$1()
 ], CreateCalendarForm.prototype, "subscriptionUrl", 2);

crates/frontend/public/assets/js/index-b86iLJlP.mjs

@@ -122,7 +122,11 @@ const o = /* @__PURE__ */ new WeakMap(), n = e$1(class extends f {
     this.rt(this.ct);
   }
 });
+function escapeXml(unsafe) {
+  return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
 export {
+  escapeXml as a,
   e,
   n
 };

crates/frontend/public/assets/style.css

@@ -1,21 +1,41 @@
 :root {
   --background-color: #FFF;
   --background-darker: #EEE;
+  --text-on-background-color: #111;
   --primary-color: #2F2FE1;
   --primary-color-dark: color-mix(in srgb, var(--primary-color), #000000 80%);
   --text-on-primary-color: #FFF;
   /* --color-red: #FE2060; */
   /* --color-red: #EE1D59; */
   --color-red: #E31B39;
+  --dilute-color: black;
+  --border-color: black;
 }
 
-html {
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background-color: #222;
+    --background-darker: #292929;
+    --text-on-background-color: #CACACA;
+    --primary-color: color-mix(in srgb, #2F2FE1, white 15%);
+    --primary-color-dark: color-mix(in srgb, var(--primary-color), #000000 80%);
+    --text-on-primary-color: #FFF;
+    /* --color-red: #FE2060; */
+    --color-red: #EE1D59;
+    --dilute-color: white;
+    --border-color: color-mix(in srgb, var(--background-color), var(--dilute-color) 15%);
+  }
+}
+
+html,
+dialog {
   background-color: var(--background-color);
+  color: var(--text-on-background-color);
 }
 
 body {
   /* position: relative; */
-  font-family: sans-serif;
+  font-family: 'Noto Sans', Helvetica, Arial, sans-serif;
   margin: 0 auto;
   max-width: 1200px;
   min-height: 100%;
@@ -29,32 +49,65 @@ body {
   padding: 12px;
 }
 
+a {
+  color: var(--text-on-background-color);
+}
+
 header {
   background: var(--background-darker);
-  height: 60px;
+  min-height: 60px;
   font-weight: bold;
   display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
   align-items: center;
-  padding: 12px;
+  padding: 4px 12px;
 
-  border: 2px solid black;
+  border: 2px solid var(--border-color);
   border-radius: 12px;
   margin: 12px;
   box-shadow: 4px 2px 12px -5px black;
 
-  a {
+  display: flex;
+  justify-content: space-between;
+
+  a.logo {
     font-size: 2em;
     text-decoration: none;
-    color: black;
+  }
+
+  nav {
+    display: flex;
+
+    border-radius: 12px;
+    background: color-mix(in srgb, var(--background-darker), var(--dilute-color) 5%);
+
+    a {
+      text-decoration: none;
+      margin: 4px 8px;
+      padding: 8px 12px;
+      border-radius: 12px;
+      background: color-mix(in srgb, var(--background-darker), var(--dilute-color) 2%);
+
+      &:hover {
+        background: color-mix(in srgb, var(--background-darker), var(--dilute-color) 20%);
+      }
+
+      &.active {
+        background: color-mix(in srgb, var(--background-darker), var(--dilute-color) 15%);
+      }
+
+      svg.icon {
+        width: 1.3em;
+        vertical-align: bottom;
+        margin-right: 6px;
+      }
+    }
   }
 
 
   .logout_form {
     display: contents;
-
-    button {
-      margin-left: auto;
-    }
   }
 }
 
@@ -69,7 +122,7 @@ button,
 .button {
   border: none;
   background: var(--primary-color);
-  padding: 10px 16px;
+  padding: 8px 16px;
   border-radius: 8px;
   color: var(--text-on-primary-color);
   font-size: 0.9em;
@@ -97,7 +150,7 @@ input[type="password"] {
 }
 
 section {
-  border: 1px solid black;
+  border: 1px solid var(--border-color);
   border-radius: 12px;
   box-shadow: 4px 2px 12px -8px black;
   border-collapse: collapse;
@@ -108,7 +161,7 @@ section {
 }
 
 table {
-  border: 1px solid black;
+  border: 1px solid var(--border-color);
   border-radius: 12px;
   box-shadow: 4px 2px 12px -6px black;
   border-collapse: collapse;
@@ -118,7 +171,7 @@ table {
   td,
   th {
     padding: 8px;
-    border: 1px solid black;
+    border: 1px solid var(--border-color);
     width: max-content;
   }
 
@@ -126,12 +179,8 @@ table {
     height: 40px;
   }
 
-  /* tr:nth-of-type(2n+1) { */
-  /*   background: var(--background-darker); */
-  /* } */
-
   tr:hover {
-    background: #DDD;
+    background: color-mix(in srgb, var(--background-color), var(--dilute-color) 10%);
   }
 
   tr:first-child th {
@@ -151,88 +200,108 @@ table {
   }
 }
 
-#page-user {
+ul.collection-list {
-  ul {
+  padding-left: 0;
-    padding-left: 0;
 
-    li.collection-list-item {
+  li.collection-list-item {
-      list-style: none;
+    list-style: none;
-      display: contents;
+    display: block;
+    position: relative;
+    background: color-mix(in srgb, var(--background-color), var(--dilute-color) 5%);
+    border: 2px solid var(--border-color);
+    border-radius: 12px;
+    margin: 12px 0;
+    box-shadow: 4px 2px 12px -6px black;
+    overflow: hidden;
 
-      a {
+    a {
-        background: #EEE;
+      position: absolute;
-        display: grid;
+      inset: 2px;
-        min-height: 80px;
+    }
-        grid-template-areas:
-          ".                .                 color-chip"
-          "title            comps             color-chip"
-          "description      description       color-chip"
-          "subscription-url subscription-url  color-chip"
-          "actions          actions           color-chip"
-          ".                .                 color-chip";
-        grid-template-rows: 12px auto auto auto auto 12px;
-        grid-template-columns: min-content auto 80px;
-        row-gap: 4px;
-        color: inherit;
-        text-decoration: none;
-        padding-left: 12px;
 
-        border: 2px solid black;
+    .inner {
-        border-radius: 12px;
+      display: grid;
-        margin: 12px;
+      min-height: 80px;
-        box-shadow: 4px 2px 12px -6px black;
+      height: fit-content;
-        overflow: hidden;
+      grid-template-areas:
+        ".                .                 color-chip"
+        "title            comps             color-chip"
+        "description      description       color-chip"
+        "subscription-url subscription-url  color-chip"
+        "metadata         metadata          color-chip"
+        "actions          actions           color-chip"
+        ".                .                 color-chip";
+      grid-template-rows: 12px auto auto auto auto auto 12px;
+      grid-template-columns: min-content auto 80px;
+      row-gap: 4px;
+      color: inherit;
+      text-decoration: none;
+      padding-left: 12px;
 
-        .title {
+      position: relative;
-          font-weight: bold;
+      z-index: 1;
-          grid-area: title;
+      pointer-events: none;
-          margin-right: 12px;
+
-          white-space: nowrap;
+      a,
-        }
+      button {
+        pointer-events: all;
+        cursor: pointer;
+      }
+
+      .title {
+        font-weight: bold;
+        grid-area: title;
+        margin-right: 12px;
+        white-space: nowrap;
+      }
+
+      span {
+        margin: 8px initial;
+      }
+
+      .comps {
+        grid-area: comps;
 
         span {
-          margin: 8px initial;
+          margin: 0 2px;
-        }
+          background: var(--primary-color);
-
+          color: var(--text-on-primary-color);
-        .comps {
+          font-size: .8em;
-          grid-area: comps;
+          padding: 3px 8px;
-
+          border-radius: 12px;
-          span {
-            margin: 0 2px;
-            background: var(--primary-color);
-            color: var(--text-on-primary-color);
-            font-size: .8em;
-            padding: 3px 8px;
-            border-radius: 12px;
-          }
-        }
-
-        .description {
-          grid-area: description;
-          white-space: nowrap;
-        }
-
-        .subscription-url {
-          grid-area: subscription-url;
-          white-space: nowrap;
-        }
-
-        .color-chip {
-          background: var(--color);
-          grid-area: color-chip;
-        }
-
-        .actions {
-          grid-area: actions;
-          width: fit-content;
-          display: flex;
-          gap: 12px;
-        }
-
-        &:hover {
-          background: #DDD;
         }
       }
+
+      .description {
+        grid-area: description;
+        white-space: nowrap;
+      }
+
+      .metadata {
+        grid-area: metadata;
+        white-space: nowrap;
+      }
+
+      .subscription-url {
+        grid-area: subscription-url;
+        white-space: nowrap;
+      }
+
+      .color-chip {
+        background: var(--color);
+        grid-area: color-chip;
+      }
+
+      .actions {
+        grid-area: actions;
+        width: fit-content;
+        display: flex;
+        gap: 12px;
+      }
+    }
+
+    &:hover {
+      background: color-mix(in srgb, var(--background-color), var(--dilute-color) 10%);
     }
   }
 }
@@ -242,7 +311,7 @@ textarea {
 }
 
 dialog {
-  border: 1px solid black;
+  border: 1px solid var(--border-color);
   border-radius: 16px;
   padding: 32px;
 }
@@ -252,6 +321,28 @@ footer {
   justify-content: center;
   margin-top: 32px;
   gap: 24px;
-  /* position: absolute; */
   bottom: 20px;
 }
+
+input[type="text"],
+input[type="password"],
+input[type="color"],
+select {
+  background: color-mix(in srgb, var(--background-color), var(--dilute-color) 10%);
+  border: 2px solid var(--border-color);
+  padding: 6px 6px;
+  color: var(--text-on-background-color);
+  margin: 2px;
+  border-radius: 8px;
+
+  &:hover,
+  &:focus {
+    background: color-mix(in srgb, var(--background-color), var(--dilute-color) 20%);
+  }
+}
+
+svg.icon {
+  stroke-width: 2px;
+  color: var(--text-on-background-color);
+  stroke: var(--text-on-background-color);
+}

crates/frontend/public/templates/components/addressbooks_section.html

@@ -1,56 +0,0 @@
-<section>
-  <h2>Addressbooks</h2>
-  <ul>
-    {% for addressbook in addressbooks %}
-    <li class="collection-list-item">
-      <a href="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}">
-        <span class="title">
-          {%- if addressbook.principal != user.id -%}{{ addressbook.principal }}/{%- endif -%}
-          {{ addressbook.displayname.to_owned().unwrap_or(addressbook.id.to_owned()) }}
-        </span>
-        <span class="description">
-          {% if let Some(description) = addressbook.description %}{{ description }}{% endif %}
-        </span>
-        <div class="actions">
-          <form action="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}" target="_blank"
-            method="GET">
-            <button type="submit">Download</button>
-          </form>
-          <delete-button trash
-            href="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}"></delete-button>
-        </div>
-      </a>
-    </li>
-    {% else %}
-    You do not have any addressbooks yet
-    {% endfor %}
-  </ul>
-  {%if !deleted_addressbooks.is_empty() %}
-  <h3>Deleted Addressbooks</h3>
-  <ul>
-    {% for addressbook in deleted_addressbooks %}
-    <li class="collection-list-item">
-      <a href="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}">
-        <span class="title">
-          {%- if addressbook.principal != user.id -%}{{ addressbook.principal }}/{%- endif -%}
-          {{ addressbook.displayname.to_owned().unwrap_or(addressbook.id.to_owned()) }}
-        </span>
-        <span class="description">
-          {% if let Some(description) = addressbook.description %}{{ description }}{% endif %}
-        </span>
-        <div class="actions">
-          <form action="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}/restore"
-            method="POST" class="restore-form">
-            <button type="submit">Restore</button>
-          </form>
-          <delete-button href="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}"></delete-button>
-        </div>
-      </a>
-    </li>
-    {% endfor %}
-  </ul>
-  {% endif %}
-
-  <create-addressbook-form user="{{ user.id }}"></create-addressbook-form>
-
-</section>

crates/frontend/public/templates/components/calendars_section.html

@@ -1,72 +0,0 @@
-<section>
-  <h2>Calendars</h2>
-  <ul>
-    {% for calendar in calendars %}
-    {% let color = calendar.color.to_owned().unwrap_or("transparent".to_owned()) %}
-    <li class="collection-list-item" style="--color: {{ color }}">
-      <a href="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id }}">
-        <span class="title">
-          {%- if calendar.principal != user.id -%}{{ calendar.principal }}/{%- endif -%}
-          {{ calendar.displayname.to_owned().unwrap_or(calendar.id.to_owned()) }}
-        </span>
-        <div class="comps">
-          {% for comp in calendar.components %}
-          <span>{{ comp }}</span>
-          {% endfor %}
-        </div>
-        <span class="description">
-          {% if let Some(description) = calendar.description %}{{ description }}{% endif %}
-        </span>
-        {% if let Some(subscription_url) = calendar.subscription_url %}
-        <span class="subscription-url">{{ subscription_url }}</span>
-        {% endif %}
-        <div class="actions">
-          <form action="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}" target="_blank" method="GET">
-            <button type="submit">Download</button>
-          </form>
-          {% if !calendar.id.starts_with("_birthdays_") %}
-          <delete-button trash href="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}"></delete-button>
-          {% endif %}
-        </div>
-        <div class="color-chip"></div>
-      </a>
-    </li>
-    {% else %}
-    You do not have any calendars yet
-    {% endfor %}
-  </ul>
-  {%if !deleted_calendars.is_empty() %}
-  <h3>Deleted Calendars</h3>
-  <ul>
-    {% for calendar in deleted_calendars %}
-    {% let color = calendar.color.to_owned().unwrap_or("transparent".to_owned()) %}
-    <li class="collection-list-item" style="--color: {{ color }}">
-      <a href="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id}}">
-        <span class="title">
-          {%- if calendar.principal != user.id -%}{{ calendar.principal }}/{%- endif -%}
-          {{ calendar.displayname.to_owned().unwrap_or(calendar.id.to_owned()) }}
-        </span>
-        <div class="comps">
-          {% for comp in calendar.components %}
-          <span>{{ comp }}</span>
-          {% endfor %}
-        </div>
-        <span class="description">
-          {% if let Some(description) = calendar.description %}{{ description }}{% endif %}
-        </span>
-        <div class="actions">
-          <form action="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id}}/restore" method="POST"
-            class="restore-form">
-            <button type="submit">Restore</button>
-          </form>
-          <delete-button href="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}"></delete-button>
-        </div>
-        <div class="color-chip"></div>
-      </a>
-    </li>
-    {% endfor %}
-  </ul>
-  {% endif %}
-  <create-calendar-form user="{{ user.id }}"></create-calendar-form>
-
-</section>

crates/frontend/public/templates/components/profile_section.html

@@ -1,58 +0,0 @@
-<section>
-  <h2>Profile</h2>
-
-  {% let groups = user.memberships_without_self() %}
-  {% if groups.len() > 0 %}
-  <h3>Groups</h3>
-  <ul>
-    {% for group in groups %}
-    <li>{{ group }}</li>
-    {% endfor %}
-  </ul>
-  {% endif %}
-
-  <h3>App tokens</h3>
-  <table id="app-tokens">
-    <tr>
-      <th>Name</th>
-      <th>Created at</th>
-      <th></th>
-    </tr>
-    {% for app_token in app_tokens %}
-    <tr>
-      <td>{{ app_token.name }}</td>
-      <td>
-        {% if let Some(created_at) = app_token.created_at %}
-        {{ chrono_humanize::HumanTime::from(created_at.to_owned()) }}
-        {% endif %}
-      </td>
-      <td>
-        <form action="/frontend/user/{{ user.id }}/app_token/{{ app_token.id }}/delete" method="POST">
-          <button type="submit" class="delete">Delete</button>
-        </form>
-      </td>
-    </tr>
-    {% endfor %}
-    <tr class="generate">
-      <td>
-        <form action="/frontend/user/{{ user.id }}/app_token" method="POST" id="form_generate_app_token">
-          <label class="font_bold" for="generate_app_token_name">App name</label>
-          <input type="text" name="name" id="generate_app_token_name" />
-        </form>
-      </td>
-      <td></td>
-      <td>
-        <button type="submit" form="form_generate_app_token">Generate</button>
-        {% if is_apple %}
-        <button type="submit" form="form_generate_app_token" name="apple" value="true">Apple Configuration Profile
-          (contains token)</button>
-        {% endif %}
-      </td>
-    </tr>
-  </table>
-  {% if let Some(hostname) = davx5_hostname %}
-  <a
-    href="intent://{{ hostname | urlencode }}#Intent;action=android.intent.action.VIEW;component=at.bitfire.davdroid.ui.setup.LoginActivity;scheme=davx5;package=at.bitfire.davdroid;S.loginFlow=1;end">Configure
-    in DAVx5</a>
-  {% endif %}
-</section>

crates/frontend/public/templates/components/sections/addressbooks_section.html

@@ -0,0 +1,62 @@
+<h2>{{user.id }}'s Addressbooks</h2>
+<ul class="collection-list">
+  {% for (meta, addressbook) in addressbooks %}
+  <li class="collection-list-item">
+    <a href="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}"></a>
+    <div class="inner">
+      <span class="title">
+        {%- if addressbook.principal != user.id -%}{{ addressbook.principal }}/{%- endif -%}
+        {{ addressbook.displayname.to_owned().unwrap_or(addressbook.id.to_owned()) }}
+      </span>
+      <span class="description">
+        {% if let Some(description) = addressbook.description %}{{ description }}{% endif %}
+      </span>
+      <div class="actions">
+        <form action="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}" target="_blank"
+          method="GET">
+          <button type="submit">Download</button>
+        </form>
+        <delete-button trash
+          href="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}"></delete-button>
+      </div>
+      <div class="metadata">
+        {{ meta.len }} ({{ meta.size | filesizeformat }}) objects, {{ meta.deleted_len }} ({{ meta.deleted_size | filesizeformat }}) deleted objects
+      </div>
+    </div>
+  </li>
+  {% else %}
+  You do not have any addressbooks yet
+  {% endfor %}
+</ul>
+{%if !deleted_addressbooks.is_empty() %}
+<h3>Deleted Addressbooks</h3>
+<ul class="collection-list">
+  {% for (meta, addressbook) in deleted_addressbooks %}
+  <li class="collection-list-item">
+    <a href="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}"></a>
+    <div class="inner">
+      <span class="title">
+        {%- if addressbook.principal != user.id -%}{{ addressbook.principal }}/{%- endif -%}
+        {{ addressbook.displayname.to_owned().unwrap_or(addressbook.id.to_owned()) }}
+      </span>
+      <span class="description">
+        {% if let Some(description) = addressbook.description %}{{ description }}{% endif %}
+      </span>
+      <div class="actions">
+        <form action="/frontend/user/{{ addressbook.principal }}/addressbook/{{ addressbook.id}}/restore"
+          method="POST" class="restore-form">
+          <button type="submit">Restore</button>
+        </form>
+        <delete-button href="/carddav/principal/{{ addressbook.principal }}/{{ addressbook.id }}"></delete-button>
+      </div>
+      <div class="metadata">
+        {{ meta.len }} ({{ meta.size | filesizeformat }}) objects, {{ meta.deleted_len }} ({{ meta.deleted_size | filesizeformat }}) deleted objects
+      </div>
+    </div>
+  </li>
+  {% endfor %}
+</ul>
+{% endif %}
+
+<create-addressbook-form user="{{ user.id }}"></create-addressbook-form>
+

crates/frontend/public/templates/components/sections/calendars_section.html

@@ -0,0 +1,78 @@
+<h2>{{ user.id }}'s Calendars</h2>
+<ul class="collection-list">
+  {% for (meta, calendar) in calendars %}
+  {% let color = calendar.color.to_owned().unwrap_or("transparent".to_owned()) %}
+  <li class="collection-list-item" style="--color: {{ color }}">
+    <a href="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id }}"></a>
+    <div class="inner">
+      <span class="title">
+        {%- if calendar.principal != user.id -%}{{ calendar.principal }}/{%- endif -%}
+        {{ calendar.displayname.to_owned().unwrap_or(calendar.id.to_owned()) }}
+      </span>
+      <div class="comps">
+        {% for comp in calendar.components %}
+        <span>{{ comp }}</span>
+        {% endfor %}
+      </div>
+      <span class="description">
+        {% if let Some(description) = calendar.description %}{{ description }}{% endif %}
+      </span>
+      {% if let Some(subscription_url) = calendar.subscription_url %}
+      <span class="subscription-url">{{ subscription_url }}</span>
+      {% endif %}
+      <div class="actions">
+        <form action="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}" target="_blank" method="GET">
+          <button type="submit">Download</button>
+        </form>
+        {% if !calendar.id.starts_with("_birthdays_") %}
+        <delete-button trash href="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}"></delete-button>
+        {% endif %}
+      </div>
+      <div class="metadata">
+        {{ meta.len }} ({{ meta.size | filesizeformat }}) objects, {{ meta.deleted_len }} ({{ meta.deleted_size | filesizeformat }}) deleted objects
+      </div>
+      <div class="color-chip"></div>
+    </div>
+  </li>
+  {% else %}
+  You do not have any calendars yet
+  {% endfor %}
+</ul>
+{%if !deleted_calendars.is_empty() %}
+<h3>Deleted Calendars</h3>
+<ul class="collection-list">
+  {% for (meta, calendar) in deleted_calendars %}
+  {% let color = calendar.color.to_owned().unwrap_or("transparent".to_owned()) %}
+  <li class="collection-list-item" style="--color: {{ color }}">
+    <a href="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id}}"></a>
+    <div class="inner">
+      <span class="title">
+        {%- if calendar.principal != user.id -%}{{ calendar.principal }}/{%- endif -%}
+        {{ calendar.displayname.to_owned().unwrap_or(calendar.id.to_owned()) }}
+      </span>
+      <div class="comps">
+        {% for comp in calendar.components %}
+        <span>{{ comp }}</span>
+        {% endfor %}
+      </div>
+      <span class="description">
+        {% if let Some(description) = calendar.description %}{{ description }}{% endif %}
+      </span>
+      <div class="actions">
+        <form action="/frontend/user/{{ calendar.principal }}/calendar/{{ calendar.id}}/restore" method="POST"
+          class="restore-form">
+          <button type="submit">Restore</button>
+        </form>
+        <delete-button href="/caldav/principal/{{ calendar.principal }}/{{ calendar.id }}"></delete-button>
+      </div>
+      <div class="metadata">
+        {{ meta.len }} ({{ meta.size | filesizeformat }}) objects, {{ meta.deleted_len }} ({{ meta.deleted_size | filesizeformat }}) deleted objects
+      </div>
+      <div class="color-chip"></div>
+    </div>
+  </li>
+  {% endfor %}
+</ul>
+{% endif %}
+<create-calendar-form user="{{ user.id }}"></create-calendar-form>
+

crates/frontend/public/templates/components/sections/profile_section.html

@@ -0,0 +1,56 @@
+<h2>{{ user.id }}'s Profile</h2>
+
+{% let groups = user.memberships_without_self() %}
+{% if groups.len() > 0 %}
+<h3>Groups</h3>
+<ul>
+  {% for group in groups %}
+  <li>{{ group }}</li>
+  {% endfor %}
+</ul>
+{% endif %}
+
+<h3>App tokens</h3>
+<table id="app-tokens">
+  <tr>
+    <th>Name</th>
+    <th>Created at</th>
+    <th></th>
+  </tr>
+  {% for app_token in app_tokens %}
+  <tr>
+    <td>{{ app_token.name }}</td>
+    <td>
+      {% if let Some(created_at) = app_token.created_at %}
+      {{ chrono_humanize::HumanTime::from(created_at.to_owned()) }}
+      {% endif %}
+    </td>
+    <td>
+      <form action="/frontend/user/{{ user.id }}/app_token/{{ app_token.id }}/delete" method="POST">
+        <button type="submit" class="delete">Delete</button>
+      </form>
+    </td>
+  </tr>
+  {% endfor %}
+  <tr class="generate">
+    <td>
+      <form action="/frontend/user/{{ user.id }}/app_token" method="POST" id="form_generate_app_token">
+        <label class="font_bold" for="generate_app_token_name">App name</label>
+        <input type="text" name="name" id="generate_app_token_name" />
+      </form>
+    </td>
+    <td></td>
+    <td>
+      <button type="submit" form="form_generate_app_token">Generate</button>
+      {% if is_apple %}
+      <button type="submit" form="form_generate_app_token" name="apple" value="true">Apple Configuration Profile
+        (contains token)</button>
+      {% endif %}
+    </td>
+  </tr>
+</table>
+{% if let Some(hostname) = davx5_hostname %}
+<a
+  href="intent://{{ hostname | urlencode }}#Intent;action=android.intent.action.VIEW;component=at.bitfire.davdroid.ui.setup.LoginActivity;scheme=davx5;package=at.bitfire.davdroid;S.loginFlow=1;end">Configure
+  in DAVx5</a>
+{% endif %}

crates/frontend/public/templates/icons/calendar.svg

@@ -0,0 +1,8 @@
+<!-- Adapted from https://iconoir.com/ -->
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="24px" height="24px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="icon">
+  <path d="M15 4V2M15 4V6M15 4H10.5M3 10V19C3 20.1046 3.89543 21 5 21H19C20.1046 21 21 20.1046 21 19V10H3Z" stroke-linecap="round" stroke-linejoin="round"></path>
+  <path d="M3 10V6C3 4.89543 3.89543 4 5 4H7" stroke-linecap="round" stroke-linejoin="round"></path>
+  <path d="M7 2V6" stroke-linecap="round" stroke-linejoin="round"></path>
+  <path d="M21 10V6C21 4.89543 20.1046 4 19 4H18.5" stroke-linecap="round" stroke-linejoin="round"></path>
+</svg>

crates/frontend/public/templates/icons/group.svg

@@ -0,0 +1,8 @@
+<!-- Adapted from https://iconoir.com/ -->
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="24px" height="24px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="icon">
+  <path d="M1 20V19C1 15.134 4.13401 12 8 12V12C11.866 12 15 15.134 15 19V20" stroke-linecap="round"></path>
+  <path d="M13 14V14C13 11.2386 15.2386 9 18 9V9C20.7614 9 23 11.2386 23 14V14.5" stroke-linecap="round"></path>
+  <path d="M8 12C10.2091 12 12 10.2091 12 8C12 5.79086 10.2091 4 8 4C5.79086 4 4 5.79086 4 8C4 10.2091 5.79086 12 8 12Z" stroke-linecap="round" stroke-linejoin="round"></path>
+  <path d="M18 9C19.6569 9 21 7.65685 21 6C21 4.34315 19.6569 3 18 3C16.3431 3 15 4.34315 15 6C15 7.65685 16.3431 9 18 9Z" stroke-linecap="round" stroke-linejoin="round"></path>
+</svg>

crates/frontend/public/templates/icons/user.svg

@@ -0,0 +1,6 @@
+<!-- Adapted from https://iconoir.com/ -->
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="24px" height="24px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="icon">
+  <path d="M5 20V19C5 15.134 8.13401 12 12 12V12C15.866 12 19 15.134 19 19V20" stroke-linecap="round" stroke-linejoin="round"></path>
+  <path d="M12 12C14.2091 12 16 10.2091 16 8C16 5.79086 14.2091 4 12 4C9.79086 4 8 5.79086 8 8C8 10.2091 9.79086 12 12 12Z" stroke-linecap="round" stroke-linejoin="round"></path>
+</svg>

crates/frontend/public/templates/layouts/default.html

@@ -12,7 +12,8 @@
 <body>
   {% block header %}
   <header>
-      <a href="/frontend/user">RustiCal</a>
+      <a class="logo" href="/frontend/user">RustiCal</a>
+      {% block header_center %}{% endblock %}
       <form method="POST" action="/frontend/logout" class="logout_form">
         <button type="submit">Log out</button>
       </form>

crates/frontend/public/templates/pages/user.html

@@ -1,19 +1,23 @@
 {% extends "layouts/default.html" %}
 
 {% block imports %}
+<template id="data-rustical-user">{{ user|json }}</template>
+<script>
+window.rusticalUser = JSON.parse(document.querySelector('#data-rustical-user').innerHTML)
+</script>
 <script type="module" src="/frontend/assets/js/create-calendar-form.mjs" async></script>
 <script type="module" src="/frontend/assets/js/create-addressbook-form.mjs" async></script>
 <script type="module" src="/frontend/assets/js/delete-button.mjs" async></script>
 {% endblock %}
-
+{% block header_center %}
-{% block content %}
+<nav class="header-center">
-<div id="page-user">
+  <a href="/frontend/user/{{ user.id }}" {% if S::name() == "profile" %}class="active"{% endif %}>{% include "icons/user.svg" %}Profile</a>
-
+  <a href="/frontend/user/{{ user.id }}/calendar" {% if S::name() == "calendars" %}class="active"{% endif %}>{% include "icons/calendar.svg" %}Calendars</a>
-<h1>Welcome {{ user.id }}!</h1>
+  <a href="/frontend/user/{{ user.id }}/addressbook" {% if S::name() == "addressbooks" %}class="active"{% endif %}>{% include "icons/group.svg" %}Addressbooks</a>
-
+</nav>
-{% include "components/profile_section.html" %}
+{% endblock %}
-{% include "components/calendars_section.html" %}
+
-{% include "components/addressbooks_section.html" %}
+{% block content %}
-
+{{ section|safe }}
 {% endblock %}
 

crates/frontend/src/lib.rs

@@ -8,6 +8,7 @@ use axum::{
 };
 use headers::{ContentType, HeaderMapExt};
 use http::{Method, StatusCode};
+use routes::{addressbooks::route_addressbooks, calendars::route_calendars};
 use rustical_oidc::{OidcConfig, OidcServiceConfig, route_get_oidc_callback, route_post_oidc};
 use rustical_store::{
     AddressbookStore, CalendarStore,
@@ -20,6 +21,7 @@ mod assets;
 mod config;
 pub mod nextcloud_login;
 mod oidc_user_store;
+pub(crate) mod pages;
 mod routes;
 
 pub use config::FrontendConfig;
@@ -56,6 +58,7 @@ pub fn frontend_router<AP: AuthenticationProvider, CS: CalendarStore, AS: Addres
             post(route_delete_app_token::<AP>),
         )
         // Calendar
+        .route("/user/{user}/calendar", get(route_calendars::<CS>))
         .route(
             "/user/{user}/calendar/{calendar}",
             get(route_calendar::<CS>),
@@ -65,6 +68,7 @@ pub fn frontend_router<AP: AuthenticationProvider, CS: CalendarStore, AS: Addres
             post(route_calendar_restore::<CS>),
         )
         // Addressbook
+        .route("/user/{user}/addressbook", get(route_addressbooks::<AS>))
         .route(
             "/user/{user}/addressbook/{addressbook}",
             get(route_addressbook::<AS>),

crates/frontend/src/pages/mod.rs

@@ -0,0 +1 @@
+pub mod user;

crates/frontend/src/pages/user.rs

@@ -0,0 +1,14 @@
+use askama::Template;
+use askama_web::WebTemplate;
+use rustical_store::auth::Principal;
+
+pub trait Section: Template {
+    fn name() -> &'static str;
+}
+
+#[derive(Template, WebTemplate)]
+#[template(path = "pages/user.html")]
+pub struct UserPage<S: Section> {
+    pub user: Principal,
+    pub section: S,
+}

crates/frontend/src/routes/addressbooks.rs

@@ -0,0 +1,75 @@
+use std::sync::Arc;
+
+use askama::Template;
+use askama_web::WebTemplate;
+use axum::{Extension, extract::Path, response::IntoResponse};
+use http::StatusCode;
+use rustical_store::{Addressbook, AddressbookStore, CollectionMetadata, auth::Principal};
+
+use crate::pages::user::{Section, UserPage};
+
+impl Section for AddressbooksSection {
+    fn name() -> &'static str {
+        "addressbooks"
+    }
+}
+
+#[derive(Template, WebTemplate)]
+#[template(path = "components/sections/addressbooks_section.html")]
+pub struct AddressbooksSection {
+    pub user: Principal,
+    pub addressbooks: Vec<(CollectionMetadata, Addressbook)>,
+    pub deleted_addressbooks: Vec<(CollectionMetadata, Addressbook)>,
+}
+
+pub async fn route_addressbooks<AS: AddressbookStore>(
+    Path(user_id): Path<String>,
+    Extension(addr_store): Extension<Arc<AS>>,
+    user: Principal,
+) -> impl IntoResponse {
+    if user_id != user.id {
+        return StatusCode::UNAUTHORIZED.into_response();
+    }
+
+    let mut addressbooks = vec![];
+    for group in user.memberships() {
+        addressbooks.extend(addr_store.get_addressbooks(group).await.unwrap());
+    }
+
+    let mut deleted_addressbooks = vec![];
+    for group in user.memberships() {
+        deleted_addressbooks.extend(addr_store.get_deleted_addressbooks(group).await.unwrap());
+    }
+
+    let mut addressbook_infos = vec![];
+    for addressbook in addressbooks {
+        addressbook_infos.push((
+            addr_store
+                .addressbook_metadata(&addressbook.principal, &addressbook.id)
+                .await
+                .unwrap(),
+            addressbook,
+        ));
+    }
+
+    let mut deleted_addressbook_infos = vec![];
+    for addressbook in deleted_addressbooks {
+        deleted_addressbook_infos.push((
+            addr_store
+                .addressbook_metadata(&addressbook.principal, &addressbook.id)
+                .await
+                .unwrap(),
+            addressbook,
+        ));
+    }
+
+    UserPage {
+        section: AddressbooksSection {
+            user: user.clone(),
+            addressbooks: addressbook_infos,
+            deleted_addressbooks: deleted_addressbook_infos,
+        },
+        user,
+    }
+    .into_response()
+}

crates/frontend/src/routes/calendars.rs

@@ -0,0 +1,74 @@
+use std::sync::Arc;
+
+use crate::pages::user::{Section, UserPage};
+use askama::Template;
+use askama_web::WebTemplate;
+use axum::{Extension, extract::Path, response::IntoResponse};
+use http::StatusCode;
+use rustical_store::{Calendar, CalendarStore, CollectionMetadata, auth::Principal};
+
+impl Section for CalendarsSection {
+    fn name() -> &'static str {
+        "calendars"
+    }
+}
+
+#[derive(Template, WebTemplate)]
+#[template(path = "components/sections/calendars_section.html")]
+pub struct CalendarsSection {
+    pub user: Principal,
+    pub calendars: Vec<(CollectionMetadata, Calendar)>,
+    pub deleted_calendars: Vec<(CollectionMetadata, Calendar)>,
+}
+
+pub async fn route_calendars<CS: CalendarStore>(
+    Path(user_id): Path<String>,
+    Extension(cal_store): Extension<Arc<CS>>,
+    user: Principal,
+) -> impl IntoResponse {
+    if user_id != user.id {
+        return StatusCode::UNAUTHORIZED.into_response();
+    }
+
+    let mut calendars = vec![];
+    for group in user.memberships() {
+        calendars.extend(cal_store.get_calendars(group).await.unwrap());
+    }
+
+    let mut calendar_infos = vec![];
+    for calendar in calendars {
+        calendar_infos.push((
+            cal_store
+                .calendar_metadata(&calendar.principal, &calendar.id)
+                .await
+                .unwrap(),
+            calendar,
+        ));
+    }
+
+    let mut deleted_calendars = vec![];
+    for group in user.memberships() {
+        deleted_calendars.extend(cal_store.get_deleted_calendars(group).await.unwrap());
+    }
+
+    let mut deleted_calendar_infos = vec![];
+    for calendar in deleted_calendars {
+        deleted_calendar_infos.push((
+            cal_store
+                .calendar_metadata(&calendar.principal, &calendar.id)
+                .await
+                .unwrap(),
+            calendar,
+        ));
+    }
+
+    UserPage {
+        section: CalendarsSection {
+            user: user.clone(),
+            calendars: calendar_infos,
+            deleted_calendars: deleted_calendar_infos,
+        },
+        user,
+    }
+    .into_response()
+}

crates/frontend/src/routes/mod.rs

@@ -1,5 +1,7 @@
 pub mod addressbook;
+pub mod addressbooks;
 pub mod app_token;
 pub mod calendar;
+pub mod calendars;
 pub mod login;
 pub mod user;

crates/frontend/src/routes/user.rs

@@ -11,19 +11,23 @@ use axum_extra::{TypedHeader, extract::Host};
 use headers::UserAgent;
 use http::StatusCode;
 use rustical_store::{
-    Addressbook, AddressbookStore, Calendar, CalendarStore,
+    AddressbookStore, CalendarStore,
     auth::{AppToken, AuthenticationProvider, Principal},
 };
 
+use crate::pages::user::{Section, UserPage};
+
+impl Section for ProfileSection {
+    fn name() -> &'static str {
+        "profile"
+    }
+}
+
 #[derive(Template, WebTemplate)]
-#[template(path = "pages/user.html")]
+#[template(path = "components/sections/profile_section.html")]
-pub struct UserPage {
+pub struct ProfileSection {
     pub user: Principal,
     pub app_tokens: Vec<AppToken>,
-    pub calendars: Vec<Calendar>,
-    pub deleted_calendars: Vec<Calendar>,
-    pub addressbooks: Vec<Addressbook>,
-    pub deleted_addressbooks: Vec<Addressbook>,
     pub is_apple: bool,
     pub davx5_hostname: Option<String>,
 }
@@ -69,14 +73,13 @@ pub async fn route_user_named<
     let davx5_hostname = user_agent.as_str().contains("Android").then_some(host);
 
     UserPage {
-        app_tokens: auth_provider.get_app_tokens(&user.id).await.unwrap(),
+        section: ProfileSection {
-        calendars,
+            user: user.clone(),
-        deleted_calendars,
+            app_tokens: auth_provider.get_app_tokens(&user.id).await.unwrap(),
-        addressbooks,
+            is_apple,
-        deleted_addressbooks,
+            davx5_hostname,
+        },
         user,
-        is_apple,
-        davx5_hostname,
     }
     .into_response()
 }

crates/store/src/addressbook_store.rs

@@ -1,4 +1,4 @@
-use crate::{Error, addressbook::Addressbook};
+use crate::{CollectionMetadata, Error, addressbook::Addressbook};
 use async_trait::async_trait;
 use rustical_ical::AddressObject;
 
@@ -35,6 +35,12 @@ pub trait AddressbookStore: Send + Sync + 'static {
         synctoken: i64,
     ) -> Result<(Vec<AddressObject>, Vec<String>, i64), Error>;
 
+    async fn addressbook_metadata(
+        &self,
+        principal: &str,
+        addressbook_id: &str,
+    ) -> Result<CollectionMetadata, Error>;
+
     async fn get_objects(
         &self,
         principal: &str,

crates/store/src/auth/principal.rs

@@ -25,6 +25,7 @@ pub struct Principal {
     pub displayname: Option<String>,
     #[serde(default)]
     pub principal_type: PrincipalType,
+    #[serde(skip_serializing)]
     pub password: Option<Secret<String>>,
     #[serde(default)]
     pub memberships: Vec<String>,

crates/store/src/calendar_store.rs

@@ -1,4 +1,4 @@
-use crate::{Calendar, error::Error};
+use crate::{Calendar, CollectionMetadata, error::Error};
 use async_trait::async_trait;
 use chrono::NaiveDate;
 use rustical_ical::CalendarObject;
@@ -53,6 +53,12 @@ pub trait CalendarStore: Send + Sync + 'static {
         self.get_objects(principal, cal_id).await
     }
 
+    async fn calendar_metadata(
+        &self,
+        principal: &str,
+        cal_id: &str,
+    ) -> Result<CollectionMetadata, Error>;
+
     async fn get_objects(
         &self,
         principal: &str,

crates/store/src/combined_calendar_store.rs

@@ -135,6 +135,20 @@ impl<CS: CalendarStore, BS: CalendarStore> CalendarStore for CombinedCalendarSto
         }
     }
 
+    #[inline]
+    async fn calendar_metadata(
+        &self,
+        principal: &str,
+        cal_id: &str,
+    ) -> Result<crate::CollectionMetadata, Error> {
+        if cal_id.starts_with(BIRTHDAYS_PREFIX) {
+            self.birthday_store
+                .calendar_metadata(principal, cal_id)
+                .await
+        } else {
+            self.cal_store.calendar_metadata(principal, cal_id).await
+        }
+    }
     #[inline]
     async fn get_objects(
         &self,

crates/store/src/contact_birthday_store.rs

@@ -16,7 +16,7 @@ fn birthday_calendar(addressbook: Addressbook) -> Calendar {
         id: format!("{}{}", BIRTHDAYS_PREFIX, addressbook.id),
         displayname: addressbook
             .displayname
-            .map(|name| format!("{} birthdays", name)),
+            .map(|name| format!("{name} birthdays")),
         order: 0,
         description: None,
         color: None,
@@ -104,6 +104,17 @@ impl<AS: AddressbookStore> CalendarStore for ContactBirthdayStore<AS> {
         Ok((objects, deleted_objects, new_synctoken))
     }
 
+    async fn calendar_metadata(
+        &self,
+        principal: &str,
+        cal_id: &str,
+    ) -> Result<crate::CollectionMetadata, Error> {
+        let cal_id = cal_id
+            .strip_prefix(BIRTHDAYS_PREFIX)
+            .ok_or(Error::NotFound)?;
+        self.0.addressbook_metadata(principal, cal_id).await
+    }
+
     async fn get_objects(
         &self,
         principal: &str,

crates/store/src/lib.rs

@@ -37,3 +37,11 @@ pub struct CollectionOperation {
     pub topic: String,
     pub data: CollectionOperationInfo,
 }
+
+#[derive(Default, Debug, Clone)]
+pub struct CollectionMetadata {
+    pub len: usize,
+    pub deleted_len: usize,
+    pub size: u64,
+    pub deleted_size: u64,
+}

crates/store/src/synctoken.rs

@@ -1,7 +1,7 @@
 const SYNC_NAMESPACE: &str = "github.com/lennart-k/rustical/ns/";
 
 pub fn format_synctoken(synctoken: i64) -> String {
-    format!("{}{}", SYNC_NAMESPACE, synctoken)
+    format!("{SYNC_NAMESPACE}{synctoken}")
 }
 
 pub fn parse_synctoken(synctoken: &str) -> Option<i64> {

crates/store_sqlite/src/addressbook_store.rs

@@ -3,8 +3,8 @@ use async_trait::async_trait;
 use derive_more::derive::Constructor;
 use rustical_ical::AddressObject;
 use rustical_store::{
-    Addressbook, AddressbookStore, CollectionOperation, CollectionOperationInfo, Error,
+    Addressbook, AddressbookStore, CollectionMetadata, CollectionOperation,
-    synctoken::format_synctoken,
+    CollectionOperationInfo, Error, synctoken::format_synctoken,
 };
 use sqlx::{Acquire, Executor, Sqlite, SqlitePool, Transaction};
 use tokio::sync::mpsc::Sender;
@@ -223,6 +223,28 @@ impl SqliteAddressbookStore {
         Ok((objects, deleted_objects, new_synctoken))
     }
 
+    async fn _list_objects<'e, E: Executor<'e, Database = Sqlite>>(
+        executor: E,
+        principal: &str,
+        addressbook_id: &str,
+    ) -> Result<Vec<(u64, bool)>, rustical_store::Error> {
+        struct ObjectEntry {
+            length: u64,
+            deleted: bool,
+        }
+        Ok(sqlx::query_as!(
+            ObjectEntry,
+            "SELECT length(vcf) AS 'length!: u64', deleted_at AS 'deleted!: bool' FROM addressobjects WHERE principal = ? AND addressbook_id = ?",
+            principal,
+            addressbook_id
+        )
+        .fetch_all(executor)
+        .await.map_err(crate::Error::from)?
+        .into_iter()
+        .map(|row| (row.length, row.deleted))
+        .collect())
+    }
+
     async fn _get_objects<'e, E: Executor<'e, Database = Sqlite>>(
         executor: E,
         principal: &str,
@@ -442,6 +464,29 @@ impl AddressbookStore for SqliteAddressbookStore {
         Self::_sync_changes(&self.db, principal, addressbook_id, synctoken).await
     }
 
+    #[instrument]
+    async fn addressbook_metadata(
+        &self,
+        principal: &str,
+        addressbook_id: &str,
+    ) -> Result<CollectionMetadata, rustical_store::Error> {
+        let mut sizes = vec![];
+        let mut deleted_sizes = vec![];
+        for (size, deleted) in Self::_list_objects(&self.db, principal, addressbook_id).await? {
+            if deleted {
+                deleted_sizes.push(size)
+            } else {
+                sizes.push(size)
+            }
+        }
+        Ok(CollectionMetadata {
+            len: sizes.len(),
+            deleted_len: deleted_sizes.len(),
+            size: sizes.iter().sum(),
+            deleted_size: deleted_sizes.iter().sum(),
+        })
+    }
+
     #[instrument]
     async fn get_objects(
         &self,

crates/store_sqlite/src/calendar_store.rs

@@ -5,7 +5,7 @@ use derive_more::derive::Constructor;
 use rustical_ical::{CalDateTime, CalendarObject, CalendarObjectType};
 use rustical_store::calendar_store::CalendarQuery;
 use rustical_store::synctoken::format_synctoken;
-use rustical_store::{Calendar, CalendarStore, Error};
+use rustical_store::{Calendar, CalendarStore, CollectionMetadata, Error};
 use rustical_store::{CollectionOperation, CollectionOperationInfo};
 use sqlx::types::chrono::NaiveDateTime;
 use sqlx::{Acquire, Executor, Sqlite, SqlitePool, Transaction};
@@ -242,6 +242,28 @@ impl SqliteCalendarStore {
         Ok(())
     }
 
+    async fn _list_objects<'e, E: Executor<'e, Database = Sqlite>>(
+        executor: E,
+        principal: &str,
+        cal_id: &str,
+    ) -> Result<Vec<(u64, bool)>, rustical_store::Error> {
+        struct ObjectEntry {
+            length: u64,
+            deleted: bool,
+        }
+        Ok(sqlx::query_as!(
+            ObjectEntry,
+            "SELECT length(ics) AS 'length!: u64', deleted_at AS 'deleted!: bool' FROM calendarobjects WHERE principal = ? AND cal_id = ?",
+            principal,
+            cal_id
+        )
+        .fetch_all(executor)
+        .await.map_err(crate::Error::from)?
+        .into_iter()
+        .map(|row| (row.length, row.deleted))
+        .collect())
+    }
+
     async fn _get_objects<'e, E: Executor<'e, Database = Sqlite>>(
         executor: E,
         principal: &str,
@@ -552,6 +574,28 @@ impl CalendarStore for SqliteCalendarStore {
         Self::_calendar_query(&self.db, principal, cal_id, query).await
     }
 
+    async fn calendar_metadata(
+        &self,
+        principal: &str,
+        cal_id: &str,
+    ) -> Result<CollectionMetadata, Error> {
+        let mut sizes = vec![];
+        let mut deleted_sizes = vec![];
+        for (size, deleted) in Self::_list_objects(&self.db, principal, cal_id).await? {
+            if deleted {
+                deleted_sizes.push(size)
+            } else {
+                sizes.push(size)
+            }
+        }
+        Ok(CollectionMetadata {
+            len: sizes.len(),
+            deleted_len: deleted_sizes.len(),
+            size: sizes.iter().sum(),
+            deleted_size: deleted_sizes.iter().sum(),
+        })
+    }
+
     #[instrument]
     async fn get_objects(
         &self,

crates/store_sqlite/src/principal_store.rs

@@ -114,9 +114,11 @@ impl AuthenticationProvider for SqlitePrincipalStore {
         let password = user.password.map(Secret::into_inner);
         sqlx::query!(
             r#"
-            REPLACE INTO principals
+            INSERT INTO principals
-            (id, displayname, principal_type, password_hash)
+            (id, displayname, principal_type, password_hash) VALUES (?, ?, ?, ?)
-            VALUES (?, ?, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET
+                (displayname, principal_type, password_hash)
+                = (excluded.displayname, excluded.principal_type, excluded.password_hash)
         "#,
             user.id,
             user.displayname,
@@ -204,7 +206,7 @@ impl AuthenticationProvider for SqlitePrincipalStore {
                 None,
                 None,
                 Params {
-                    rounds: 100,
+                    rounds: 10,
                     ..Default::default()
                 },
                 &salt,

crates/xml/derive/src/xml_enum/impl_se.rs

@@ -13,12 +13,12 @@ impl Enum {
 
         quote! {
             impl #impl_generics ::rustical_xml::XmlSerialize for #ident #type_generics #where_clause {
-                fn serialize<W: ::std::io::Write>(
+                fn serialize(
                     &self,
                     ns: Option<::quick_xml::name::Namespace>,
                     tag: Option<&[u8]>,
                     namespaces: &::std::collections::HashMap<::quick_xml::name::Namespace, &[u8]>,
-                    writer: &mut ::quick_xml::Writer<W>
+                    writer: &mut ::quick_xml::Writer<&mut Vec<u8>>
                 ) -> ::std::io::Result<()> {
                     use ::quick_xml::events::{BytesEnd, BytesStart, BytesText, Event};
 

crates/xml/derive/src/xml_struct/impl_se.rs

@@ -88,12 +88,12 @@ impl NamedStruct {
 
         quote! {
             impl #impl_generics ::rustical_xml::XmlSerialize for #ident #type_generics #where_clause {
-                fn serialize<W: ::std::io::Write>(
+                fn serialize(
                     &self,
                     ns: Option<::quick_xml::name::Namespace>,
                     tag: Option<&[u8]>,
                     namespaces: &::std::collections::HashMap<::quick_xml::name::Namespace, &[u8]>,
-                    writer: &mut ::quick_xml::Writer<W>
+                    writer: &mut ::quick_xml::Writer<&mut Vec<u8>>
                 ) -> ::std::io::Result<()> {
                     use ::quick_xml::events::{BytesEnd, BytesStart, BytesText, Event};
 

crates/xml/src/se.rs

@@ -7,24 +7,24 @@ use std::collections::HashMap;
 pub use xml_derive::XmlSerialize;
 
 pub trait XmlSerialize {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()>;
 
-    fn attributes<'a>(&self) -> Option<impl IntoIterator<Item: Into<Attribute<'a>>>>;
+    fn attributes<'a>(&self) -> Option<Vec<Attribute<'a>>>;
 }
 
 impl<T: XmlSerialize> XmlSerialize for Option<T> {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         if let Some(some) = self {
             some.serialize(ns, tag, namespaces, writer)
@@ -33,17 +33,13 @@ impl<T: XmlSerialize> XmlSerialize for Option<T> {
         }
     }
 
-    #[allow(refining_impl_trait)]
     fn attributes<'a>(&self) -> Option<Vec<Attribute<'a>>> {
         None
     }
 }
 
 pub trait XmlSerializeRoot {
-    fn serialize_root<W: std::io::Write>(
+    fn serialize_root(&self, writer: &mut quick_xml::Writer<&mut Vec<u8>>) -> std::io::Result<()>;
-        &self,
-        writer: &mut quick_xml::Writer<W>,
-    ) -> std::io::Result<()>;
 
     fn serialize_to_string(&self) -> std::io::Result<String> {
         let mut buf: Vec<_> = b"<?xml version=\"1.0\" encoding=\"utf-8\"?>\n".into();
@@ -54,22 +50,19 @@ pub trait XmlSerializeRoot {
 }
 
 impl<T: XmlSerialize + XmlRootTag> XmlSerializeRoot for T {
-    fn serialize_root<W: std::io::Write>(
+    fn serialize_root(&self, writer: &mut quick_xml::Writer<&mut Vec<u8>>) -> std::io::Result<()> {
-        &self,
-        writer: &mut quick_xml::Writer<W>,
-    ) -> std::io::Result<()> {
         let namespaces = Self::root_ns_prefixes();
         self.serialize(Self::root_ns(), Some(Self::root_tag()), &namespaces, writer)
     }
 }
 
 impl XmlSerialize for () {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         let prefix = ns
             .map(|ns| namespaces.get(&ns))
@@ -96,7 +89,6 @@ impl XmlSerialize for () {
         Ok(())
     }
 
-    #[allow(refining_impl_trait)]
     fn attributes<'a>(&self) -> Option<Vec<quick_xml::events::attributes::Attribute<'a>>> {
         None
     }

crates/xml/src/value.rs

@@ -104,12 +104,12 @@ impl<T: ValueDeserialize> XmlDeserialize for T {
 }
 
 impl<T: ValueSerialize> XmlSerialize for T {
-    fn serialize<W: std::io::Write>(
+    fn serialize(
         &self,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut quick_xml::Writer<W>,
+        writer: &mut quick_xml::Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         let prefix = ns
             .map(|ns| namespaces.get(&ns))
@@ -140,7 +140,6 @@ impl<T: ValueSerialize> XmlSerialize for T {
         Ok(())
     }
 
-    #[allow(refining_impl_trait)]
     fn attributes<'a>(&self) -> Option<Vec<quick_xml::events::attributes::Attribute<'a>>> {
         None
     }

crates/xml/tests/se_struct.rs

@@ -124,12 +124,12 @@ fn test_struct_serialize_with() {
         href: String,
     }
 
-    fn serialize_href<W: ::std::io::Write>(
+    fn serialize_href(
         val: &str,
         ns: Option<Namespace>,
         tag: Option<&[u8]>,
         namespaces: &HashMap<Namespace, &[u8]>,
-        writer: &mut Writer<W>,
+        writer: &mut Writer<&mut Vec<u8>>,
     ) -> std::io::Result<()> {
         val.to_uppercase().serialize(ns, tag, namespaces, writer)
     }

docs/setup/client.md

@@ -0,0 +1,60 @@
+# Client Setup
+
+## Common
+
+Following resources are available.
+
+```
+/.well-known/caldav
+# CalDAV root
+/caldav
+# Principal home
+/caldav/principal/<user_id>
+# Calendar home
+/caldav/principal/<user_id>/<calendar_id>
+/caldav/principal/<user_id>/_birthdays_<addressbook_id>
+```
+
+```
+/.well-known/carddav
+# CardDAV root
+/carddav
+# Principal home
+/carddav/principal/<user_id>
+# Addressbook home
+/carddav/principal/<user_id>/<addressbook_id>
+```
+
+### Authentication
+
+Authenticate with HTTP Basic authentication using your user id and a generated app token.
+
+## DAVx5
+
+You can set up DAVx5 through the Nextcloud login flow. Collections including group collections will automatically be discovered.
+
+## Apple Calendar
+
+You can download a configuration profile from the frontend in the app token section.
+
+**Limitation**: Group collections are not automatically discovered, for these you need to set up separate CalDAV configurations using the corresponding principal homes (but your own user id).
+
+## Evolution
+
+Set up a collection account in the account settings.
+
+**Limitation**: Group collections are not discovered. It seems as if currently you have to add each group collection manually.
+
+## Home Assistant CalDAV integration
+
+As URL specify
+
+```
+https://<your-host>/.well-known/caldav
+```
+
+For goup collections explicitly specify
+
+```
+https://<your-host>/caldav/principal/<principal>
+```

mkdocs.yml

@@ -68,6 +68,7 @@ nav:
   - Installation:
       - installation/index.md
       - Configuration: installation/configuration.md
+  - Client Setup: setup/client.md
   - OpenID Connect: setup/oidc.md
   - Developers:
       - developers/index.md

src/commands/mod.rs

@@ -1,12 +1,8 @@
-use argon2::password_hash::SaltString;
-use clap::{Parser, ValueEnum};
-use password_hash::{PasswordHasher, rand_core::OsRng};
-use pbkdf2::Params;
-use rustical_frontend::FrontendConfig;
-
 use crate::config::{
     Config, DataStoreConfig, DavPushConfig, HttpConfig, SqliteDataStoreConfig, TracingConfig,
 };
+use clap::Parser;
+use rustical_frontend::FrontendConfig;
 
 mod membership;
 pub mod principals;
@@ -33,49 +29,3 @@ pub fn cmd_gen_config(_args: GenConfigArgs) -> anyhow::Result<()> {
     println!("{generated_config}");
     Ok(())
 }
-
-#[derive(Debug, Clone, ValueEnum)]
-enum PwhashAlgorithm {
-    #[value(help = "Use this for your password")]
-    Argon2,
-    #[value(help = "Significantly faster algorithm, use for app tokens")]
-    Pbkdf2,
-}
-
-#[derive(Debug, Parser)]
-pub struct PwhashArgs {
-    #[arg(long, short = 'a')]
-    algorithm: PwhashAlgorithm,
-    #[arg(
-        long,
-        short = 'r',
-        help = "ONLY for pbkdf2: Number of rounds to calculate",
-        default_value_t = 100
-    )]
-    rounds: u32,
-}
-
-pub fn cmd_pwhash(args: PwhashArgs) -> anyhow::Result<()> {
-    println!("Enter your password:");
-    let password = rpassword::read_password()?;
-    let salt = SaltString::generate(OsRng);
-    let password_hash = match args.algorithm {
-        PwhashAlgorithm::Argon2 => argon2::Argon2::default()
-            .hash_password(password.as_bytes(), &salt)
-            .unwrap(),
-        PwhashAlgorithm::Pbkdf2 => pbkdf2::Pbkdf2
-            .hash_password_customized(
-                password.as_bytes(),
-                None,
-                None,
-                Params {
-                    rounds: args.rounds,
-                    ..Default::default()
-                },
-                &salt,
-            )
-            .unwrap(),
-    };
-    println!("{password_hash}");
-    Ok(())
-}

src/main.rs

@@ -4,8 +4,8 @@ use app::make_app;
 use axum::ServiceExt;
 use axum::extract::Request;
 use clap::{Parser, Subcommand};
+use commands::cmd_gen_config;
 use commands::principals::{PrincipalsArgs, cmd_principals};
-use commands::{cmd_gen_config, cmd_pwhash};
 use config::{DataStoreConfig, SqliteDataStoreConfig};
 use figment::Figment;
 use figment::providers::{Env, Format, Toml};
@@ -43,7 +43,6 @@ struct Args {
 #[derive(Debug, Subcommand)]
 enum Command {
     GenConfig(commands::GenConfigArgs),
-    Pwhash(commands::PwhashArgs),
     Principals(PrincipalsArgs),
 }
 
@@ -84,7 +83,6 @@ async fn main() -> Result<()> {
 
     match args.command {
         Some(Command::GenConfig(gen_config_args)) => cmd_gen_config(gen_config_args)?,
-        Some(Command::Pwhash(pwhash_args)) => cmd_pwhash(pwhash_args)?,
         Some(Command::Principals(principals_args)) => cmd_principals(principals_args).await?,
         None => {
             let config: Config = Figment::new()