Write access over CalDAV by Jaggob · Pull Request #7655 · nextcloud/deck

Jaggob · 2026-02-18T13:36:12Z

Resolves: Write access over CalDAV #2399
Target version: main

Summary

This PR adds CalDAV write support for Deck, enabling CalDAV clients to create, update, complete/uncomplete, and delete Deck cards.

It also introduces per-user CalDAV list mapping modes in Deck settings, so each user can choose how Deck lists are represented in CalDAV clients:

Default (existing behavior): list hierarchy via VTODO parent/child relationships (RELATED-TO)
One VCALENDAR per list
Single board calendar with list name in CATEGORIES
Single board calendar with list position mapped to PRIORITY

Additional changes include DAV hardening and compatibility improvements (notably for Thunderbird and Apple clients), plus backend cleanup/performance improvements in the CalDAV handling path.

Done in this PR

Added CalDAV write support for Deck cards (create/update/delete/complete)
Added per-user CalDAV list mapping modes in Deck settings
Implemented category sync (CATEGORIES) including Thunderbird interoperability
Added DAV hardening and compatibility fixes (including stale href handling)

Future TODO

Improve move semantics further for clients that still use create+delete behavior instead of true move semantics. At the current implementation moving cards with e. g. Thunderbird leads to Nextcloud saying cards have been deleted and created instead of moved (but aside from activity logs moving works fine)
Add CalDAV mapping for assignees
Add CalDAV mapping for file attachments
Improve Apple tag interoperability where Deck tags are currently not recognized as native Apple tags

Checklist

Code is properly formatted
Sign-off message is added to all commits
Tests (unit, integration, api and/or acceptance) are included
Documentation (manuals or wiki) has been updated or is not required

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 36747a6fd3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

grnd-alt

Hey, thanks for your contribution, would be nice to get this feature in. I have some smaller code-style remarks, that are partly up for discussion.

The most important remark is that one though: https://github.com/nextcloud/deck/pull/7655/changes#r2840797696

I think this should be oriented to work with tasks as much as possible before merging.

grnd-alt · 2026-02-19T15:46:43Z

+		$lastModified->setTimestamp($lastModifiedTs);
+		$event->DTSTAMP = $lastModified;
+		$event->{'LAST-MODIFIED'} = $lastModified;
+		$event->STATUS = 'NEEDS-ACTION';


why is it always needs-action? Isn't it fine to have no status as the default?

My concern was that leaving the synthetic list VTODOs without an explicit status could lead some clients to infer or write back their own status, which would make the behavior less consistent across clients. I did not test that in depth though, so this was mainly a defensive choice.

grnd-alt · 2026-02-23T13:12:32Z

@@ -95,45 +115,82 @@ protected function validateFilterForObject($object, array $filters) {
 	}

 	public function createFile($name, $data = null) {


I am not entirely fluent with the webdav protocol, but when testing this with nextcloud tasks and thunderbird the behavior was not as I would've expected it.
I could not investigate thunderbirds requests, but for nc tasks the createFile was called with a filename and after creation the same file was re-requested to display the task, the name seems not to be respected so it is not served again under that name leading to a 404.

Thanks for the review and this good catch! Somehow missed that in my testings thanks to tolerant clients.

Fixed in f95476c47:
Created cards now persist the client-provided DAV href for non-canonical names, so follow-up requests to the same resource name no longer fail with a 404 after creation. Existing cards still fall back to the canonical card-<id>.ics naming.

Fixed in dea36cf8c:
While testing that change with Thunderbird moves, it also became clear that in per_list_calendar mode Thunderbird can send the target calendar URL while still keeping the old RELATED-TO in the payload. The follow-up fix now prefers the target list from the destination calendar in that mode, so the trailing source delete no longer removes the moved card.

I also added test coverage for stored href resolution, custom-href creation, and same-board stack moves via the target calendar.

An alternative would have been to keep a fully server-generated canonical href model and add extra mapping/alias persistence for client-provided object names. That would preserve uniform resource names, but it also adds noticeably more persistence and lookup complexity.

For this PR I preferred the smaller approach of persisting a single stable DAV href per card. That means object names can be client-shaped rather than fully uniform, but it keeps the DAV object identity stable without introducing a separate DAV object layer for Deck.

This is also closer to how Nextcloud's CalDAV backend handles object URIs in general: object hrefs are persisted as part of the DAV object state, rather than being recomputed into a server-generated card-<id>.ics style name on every request. The main difference is that Deck stores that URI on the card itself instead of using a dedicated calendarobjects persistence layer like core CalDAV does.

As a small interoperability follow-up fixed in 656466f6c:
direct GET/HEAD requests to stale source hrefs after same-board list moves now return 404 instead of a placeholder object. That avoids Thunderbird treating the old source entry as a still-readable changed item, while collection/report fallback handling remains in place.

github-actions · 2026-03-05T02:16:39Z

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

Implement first working write path for Deck CalDAV objects. - allow DAV write privilege on Deck calendars - handle PUT on existing card/stack ICS objects and map VTODO fields to Deck services - add NC32 compatibility fixes in BoardMapper for empty orX() usage - add unit tests for calendar update mapping Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Follow-up fixes after real-world macOS Reminders tests. - convert COMPLETED timestamps to DateTime expected by Deck entities - provide calendar object owner/group to avoid DELETE scheduling crashes - add backend tests for delete path and COMPLETED-without-STATUS mapping Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

…bility Stabilize bidirectional task sync for Apple Reminders and Thunderbird. - implement createFile support with stack resolution and alias normalization - support delete and robust completed mapping (STATUS/COMPLETED/PERCENT-COMPLETE) - add UID/resource-name upsert logic to avoid duplicates on move-back - handle board-to-board moves by updating existing deck-card IDs - export richer VTODO metadata (DTSTAMP/CREATED/LAST-MODIFIED/PERCENT-COMPLETE) - add extensive unit tests for update/create/delete and fallback paths Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

…Labels" This reverts commit 3d0af5c. Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

- fix Deck settings CalDAV mode selector rendering - make ETag/last-modified depend on selected list mapping mode - map list priority as left=9, right=1 for Thunderbird/Apple Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

…ateFile Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

grnd-alt

I did not manage to grasp everything in here, but this feels quite spaghetti and hard to read or follow tbh. I do think this can be implemented in a more readable manner, but might as well be a skill issue on code reading on my side. However it would be nice if this could be split up to e.g. not have the list_modes in there as well and get this to be easier to review

grnd-alt · 2026-04-21T12:16:29Z

+	}
+
+	private function isSabreVCalendar($value): bool {
+		/** @psalm-suppress UndefinedClass */


wrapper function only to suppress psalm? same for VTodo

grnd-alt · 2026-04-21T12:58:22Z

+	private function extractStackIdFromRelatedTo($todo): ?int {
+		$parentCandidates = [];
+		$otherCandidates = [];
+		foreach ($todo->children() as $child) {


this for loop can be something like this using the sabre types to not do the property handling etc yourself, then you could also remove some of the helper functions.

$relatedToArray = $todo->select("RELATED-TO"); foreach($relatedToArray as $relatedTo) { $reltype = $relatedTo["RELTYPE"] ?? null; if ($reltype instanceof \Sabre\VObject\Parameter) { $reltypeValue = $reltype->getValue(); if ($reltypeValue === 'PARENT') { $parentCandidates[] = (string)$relatedTo; } else { $otherCandidates[] = (string)$relatedTo; } } }

grnd-alt · 2026-04-21T13:05:26Z

+		} elseif ($targetBoardId !== null && $currentBoardId !== $targetBoardId) {
+			$stackId = $this->getDefaultStackIdForBoard($targetBoardId);
+		} else {
+			$stackId = $card->getStackId();


this entire stackId handling is not very easily readable, and seems overly complex, it does not make clear why the stackId is selected the way it is.

grnd-alt · 2026-04-21T14:00:47Z

+		}
+	}
+
+	private function normalizeDavUriForStorage(?string $name): ?string {


weird naming, does not seem to normalize anything but rather validate.

Strange to have the parameter nullable, but OK. Personally, I would expect an exception thrown in the negative case.

Is this user controlled, though? Is the check sufficient?

grnd-alt · 2026-04-21T14:03:14Z

 		return $card;
 	}

+	public function findByDavUriLite(string $davUri, ?int $boardId = null, ?int $stackId = null, bool $includeDeleted = true): Card {


why is this named lite?

grnd-alt · 2026-04-21T14:15:48Z

 		}
+		$stack = $this->stackMapper->find($stackId);
+		$boardId = $stack->getBoardId();
+		$board = $this->boardMapper->find($boardId);


I don't think those have any benefit as the activitymanager gets board and stack data

grnd-alt · 2026-04-21T15:13:22Z

+		if ($knownBoardId !== null) {
+			$this->permissionService->checkPermission($this->boardMapper, $knownBoardId, Acl::PERMISSION_EDIT);
+		} else {
+			$this->permissionService->checkPermission($this->cardMapper, $id, Acl::PERMISSION_EDIT, allowDeletedCard: true);


only doing this check if knownBoardId is not passed feels like a security issue. If KnownBoardId does not match the board the card's on it's possible to move a card from a board where a user has only read permission. It looks like this is verified for in getBackendChildren() but that is multiple functions deep and very implicit.

blizzz

I am confused about wide parts of this PR. Some aspects maybe makes sense, but do not really belong here, about others I am really puzzled. Maybe we can extract the necessary parts and have a very specific and lean as possible change set? Aspects that are not directly related to the write access can still be implemented in a separate PR.

blizzz · 2026-04-24T13:36:45Z

+				:clearable="false"
+				label="label"
+				track-by="id"
+				:input-label="t('deck', 'CalDAV list mapping mode')" />


as a technical user, I do not know what this means. Seeing the possible value the meaning gets clearer, the main label should still be easier to understand.

Also, isn't this out of scope for the writable caldav feature and should be split into a separate PR?

blizzz · 2026-04-24T13:40:50Z

 	protected string $title = '';
 	protected $description;
 	protected $descriptionPrev;
+	protected $davUri = null;


type is missing

blizzz · 2026-04-24T13:42:00Z

 		$calendar = new VCalendar();
 		$event = $calendar->createComponent('VTODO');
 		$event->UID = 'deck-card-' . $this->getId();
+		$event->{'X-NC-DECK-CARD-ID'} = (string)$this->getId();


this is already part of the UID?

blizzz · 2026-04-24T13:44:20Z

+			if ($this->getDone()) {
+				$event->COMPLETED = $this->getDone();
+			} else {
+				$event->COMPLETED = $lastModified;


looks strange?

blizzz · 2026-04-24T13:48:08Z

+			}
 		} else {
 			$event->STATUS = 'NEEDS-ACTION';
+			$event->{'PERCENT-COMPLETE'} = 0;


blizzz · 2026-04-24T14:20:21Z

+		$qb->orderBy('order')
+			->addOrderBy('id');


The return code later suggest only one specific entry is returned, then why sorting?

blizzz · 2026-04-24T14:34:52Z

+		}
+	}
+
+	private function normalizeDavUriForStorage(?string $name): ?string {


Strange to have the parameter nullable, but OK. Personally, I would expect an exception thrown in the negative case.

Is this user controlled, though? Is the check sufficient?

blizzz · 2026-04-24T18:25:03Z

-		$card = $this->cardMapper->find($cardId);
-		$stack = $this->stackMapper->find($card->getStackId());
-		$board = $this->boardMapper->find($stack->getBoardId());
+	private function findDetailsForCard($cardOrId, ?string $subject = null, ?Stack $knownStack = null, ?array $knownBoard = null): array {


why is this extended? It does not seem that this is related to the feature?

Jaggob requested review from elzody, grnd-alt and luka-nextcloud as code owners February 18, 2026 13:36

Jaggob force-pushed the feature/cal-dav-write branch from 36747a6 to 31b37dd Compare February 18, 2026 13:42

chatgpt-codex-connector Bot reviewed Feb 18, 2026

View reviewed changes

Comment thread lib/DAV/DeckCalendarBackend.php

Comment thread lib/DAV/Calendar.php

Jaggob force-pushed the feature/cal-dav-write branch from 584dcf5 to 8f1393f Compare February 18, 2026 14:43

grnd-alt requested changes Feb 23, 2026

View reviewed changes

github-actions Bot added the feedback-requested label Mar 5, 2026

Jaggob force-pushed the feature/cal-dav-write branch 3 times, most recently from 45ec9aa to 83626ce Compare March 20, 2026 22:28

Jaggob requested a review from grnd-alt March 21, 2026 10:11

Jacob Bühler and others added 17 commits March 31, 2026 12:34

feat(caldav): map VTODO CATEGORIES to Deck labels

0252e11

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(caldav): sync CATEGORIES with Deck labels for Thunderbird

ea25188

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(deck): accept null offset in CardMapper findAll for stacks API

06ae791

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

feat(caldav): add Apple Reminders tag mapping via X-APPLE-TAGS

990261c

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

feat(caldav): add Apple tag fallback in DESCRIPTION via Deck-Labels

c698ae6

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Revert "feat(caldav): add Apple tag fallback in DESCRIPTION via Deck-…

ccfe941

…Labels" This reverts commit 3d0af5c. Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

feat(caldav): add per-user list mapping modes for CalDAV

2fffcfa

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Refactor CalDAV update handling and remove experimental move reattach

ce4ccb9

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Pass board context on delete and expose stable deck card id

8ae48c1

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Trigger CI

873c543

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Stabilize CalDAV backend after review and CI feedback

e9a2989

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Harden CalDAV ACL and deleted-card lookup

a7aca1b

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Touch source board on cross-board card moves

5745dc4

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Jaggob added 27 commits March 31, 2026 12:34

test(dav): cover app-generated calendar URI normalization

9c4e209

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

test(dav): cover in-progress status and Apple tags label sync

782d355

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

style(test): fix import ordering in dav backend tests

29b946d

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

ci: use ubuntu-latest for fork pull-request workflows

13a901d

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

chore(ci): drop workflow runner changes for upstream PR

1a9472e

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): prevent trailing deletes on stack moves and restore via cre…

8449215

…ateFile Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

chore: align small review cleanups with main

ff34287

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): persist client hrefs for created cards

331adf8

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): prefer target list on Thunderbird stack moves

28d81f9

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

refactor(db): drop non-essential mapper refactors

72753b7

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): return 404 for direct reads on stale moved hrefs

3516982

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

refactor(service): consolidate deleted-aware card lookup

1ff52bc

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): resolve href collisions within a board

ce41e62

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): align stack calendar rename and acl handling

12fc5e0

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): allow shared calendar property writes again

28e7c22

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(ci): cast activity object ids for psalm

52350d6

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): narrow stack object acl without blocking cards

5127e1d

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

style(dav): format calendar prop patch callback

a0611c7

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): centralize calendar plugin resolution

726f29c

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

chore(dav): clean up calendar placeholder handling

7ed31bd

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): limit auto-created labels from categories

7f2d27e

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): sync category changes outside card no-op updates

458a463

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

perf(dav): avoid repeated stack lookups for object etags

c679e81

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

refactor(dav): inject request and logger services

4e1c644

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

refactor(dav): inject l10n for placeholder titles

8fc6434

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(dav): avoid dropping labels on unresolved category sync

84e26f1

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

fix(tests): align phpunit mocks with dav and activity changes

a2dce36

Signed-off-by: Jaggob <37583151+Jaggob@users.noreply.github.com>

Jaggob force-pushed the feature/cal-dav-write branch from fc98830 to a2dce36 Compare March 31, 2026 10:35

grnd-alt requested changes Apr 21, 2026

View reviewed changes

blizzz reviewed Apr 24, 2026

View reviewed changes

		@@ -95,45 +115,82 @@ protected function validateFilterForObject($object, array $filters) {
		}

		public function createFile($name, $data = null) {

Conversation

Jaggob commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Done in this PR

Future TODO

Checklist

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

grnd-alt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jaggob Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

grnd-alt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blizzz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Jaggob commented Feb 18, 2026 •

edited

Loading

Jaggob Mar 14, 2026 •

edited

Loading