fix(dav): reject ambiguous nested authorization encodings

backend/api/data.py

@@ -2489,10 +2489,16 @@ async def _get_workspace_document(
     auth_context: AuthContext,
     document_id: str,
 ) -> Document:
+    organization_filter = (
+        Document.organization_id == auth_context.organization_id
+        if auth_context.organization_id is not None
+        else Document.organization_id.is_(None)
+    )
     result = await db.execute(
         select(Document).where(
             Document.document_id == document_id,
             Document.workspace_id == auth_context.workspace_id,
+            organization_filter,
         )
     )
     document = result.scalar_one_or_none()
@@ -3928,10 +3934,18 @@ async def get_data_quality_surface(
             ProjectFolder.folder_uid.asc(),
         ),
     )
+    document_organization_filter = (
+        Document.organization_id == auth_context.organization_id
+        if auth_context.organization_id is not None
+        else Document.organization_id.is_(None)
+    )
     documents = await _scoped_rows(
         db,
         select(Document)
-        .where(Document.workspace_id == auth_context.workspace_id)
+        .where(
+            Document.workspace_id == auth_context.workspace_id,
+            document_organization_filter,
+        )
         .order_by(Document.created_at.desc(), Document.document_id.asc())
         .limit(8),
     )

backend/api/dav.py

@@ -1,6 +1,5 @@
 import logging
 from html import escape as escape_xml_text
-from urllib.parse import unquote
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -13,15 +12,68 @@
 
 router = APIRouter(prefix="/dav", tags=["dav"])
 
+IMPLEMENTED_DAV_METHODS = ("OPTIONS", "PROPFIND")
+_DAV_AUTHORIZATION_PATH_MAX_CHARACTERS = 8192
+_HEX_DIGITS = frozenset("0123456789abcdefABCDEF")
+_DAV_STRUCTURAL_OCTETS = frozenset(
+    {*range(0x20), 0x2E, 0x2F, 0x5C, 0x7F}
+)
+
+
+def _residual_percent_octet(path: str, percent_index: int) -> int | None:
+    """Return the octet exposed by another decode, following nested ``%25``."""
+
+    cursor = percent_index + 1
+    while cursor + 1 < len(path):
+        pair = path[cursor : cursor + 2]
+        if pair[0] not in _HEX_DIGITS or pair[1] not in _HEX_DIGITS:
+            return None
+        octet = int(pair, 16)
+        if octet != 0x25:
+            return octet
+        cursor += 2
+    return None
+
+
+def _has_ambiguous_percent_encoding(path: str) -> bool:
+    """Detect residual encodings that another decode would make structural."""
+
+    for index, character in enumerate(path):
+        if character != "%":
+            continue
+        octet = _residual_percent_octet(path, index)
+        if octet in _DAV_STRUCTURAL_OCTETS:
+            return True
+    return False
+
 
 def _normalize_dav_authorization_path(path: str) -> str:
+    """Validate the framework-decoded DAV path without decoding it again.
+
+    ASGI routing has already decoded the request-target path once. Authorization
+    therefore treats residual percent text as data unless another decode would
+    introduce a traversal dot, separator, backslash, or control octet. Literal
+    backslashes are normalized to separators for owner/traversal checks.
+    """
+
+    if len(path) > _DAV_AUTHORIZATION_PATH_MAX_CHARACTERS:
+        raise HTTPException(
+            status_code=414,
+            detail="DAV path exceeds authorization length limit",
+        )
+    if any(ord(character) < 0x20 or ord(character) == 0x7F for character in path):
+        raise HTTPException(
+            status_code=400,
+            detail="DAV path contains control characters",
+        )
+
     normalized_path = path.replace("\\", "/")
-    for _ in range(100):
-        decoded_path = unquote(normalized_path).replace("\\", "/")
-        if decoded_path == normalized_path:
-            return normalized_path
-        normalized_path = decoded_path
-    raise HTTPException(status_code=400, detail="DAV path decoding limit exceeded")
+    if _has_ambiguous_percent_encoding(normalized_path):
+        raise HTTPException(
+            status_code=400,
+            detail="DAV path contains ambiguous percent encoding",
+        )
+    return normalized_path
 
 
 def _dav_path_owner_user_id(path: str) -> str | None:
@@ -158,73 +210,38 @@ async def _handle_project_propfind(
 
 @router.api_route(
     "/{path:path}",
-    methods=["PROPFIND", "REPORT", "MKCOL", "GET", "PUT", "DELETE", "OPTIONS"],
+    methods=list(IMPLEMENTED_DAV_METHODS),
 )
 async def dav_handler(
     request: Request,
     path: str,
     auth_context: AuthContext = Depends(get_auth_context),
     db: AsyncSession = Depends(get_db),
-):
-    """
-    Route the authenticated DAV surface that is implemented for this slice.
+) -> Response:
+    """Serve only the authenticated DAV capabilities implemented in production.
 
-    Collection discovery is served from the server-side project registry.
-    Provider-backed writeback stays fail-closed until source capability and
-    ETag/If-Match enforcement are available through signed writeback intents.
+    Project collection discovery is available through ``PROPFIND``. Unsupported
+    writeback and richer DAV verbs are deliberately not registered, so clients
+    receive ``405 Method Not Allowed`` instead of a misleading advertised
+    capability that can only return ``501 Not Implemented``.
     """
-    _ensure_dav_owner_scope(path, auth_context)
-    safe_path = repr(path)[1:-1]
+    normalized_path = _normalize_dav_authorization_path(path)
+    _ensure_dav_owner_scope(normalized_path, auth_context)
+    safe_path = repr(normalized_path)[1:-1]
     logger.info("DAV Request: %s /%s", request.method, safe_path)
 
     if request.method == "OPTIONS":
-        headers = {
-            "DAV": "1, 2, 3, calendar-access, addressbook",
-            "Allow": (
-                "OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, COPY, MOVE, MKCOL, "
-                "PROPFIND, PROPPATCH, LOCK, UNLOCK, REPORT"
-            ),
-        }
-        return Response(status_code=200, headers=headers)
-
-    if request.method == "PROPFIND":
-        return await _handle_project_propfind(
-            request=request,
-            path=path,
-            auth_context=auth_context,
-            db=db,
-        )
-
-    if request.method == "PUT":
-        body = await request.body()
-        safe_path = repr(path)[1:-1]
-        logger.info("DAV PUT received %s bytes at /%s", len(body), safe_path)
-        logger.warning(
-            "DAV PUT rejected at /%s: provider-backed DAV writeback is not "
-            "implemented; signed writeback-intent API is required",
-            safe_path,
-        )
         return Response(
-            content=(
-                "Provider-backed DAV writeback is not implemented; use signed "
-                "writeback-intent APIs until source, capability, and "
-                "ETag/If-Match checks are enforced."
-            ),
-            media_type="text/plain",
-            status_code=501,
+            status_code=200,
+            headers={
+                "DAV": "1",
+                "Allow": ", ".join(IMPLEMENTED_DAV_METHODS),
+            },
         )
 
-    logger.warning(
-        "DAV %s rejected at /%s: method is not implemented for the "
-        "provider-backed DAV gateway",
-        request.method,
-        safe_path,
-    )
-    return Response(
-        content=(
-            "Provider-backed DAV method is not implemented; use supported "
-            "PROPFIND/OPTIONS discovery or signed writeback-intent APIs."
-        ),
-        media_type="text/plain",
-        status_code=501,
+    return await _handle_project_propfind(
+        request=request,
+        path=normalized_path,
+        auth_context=auth_context,
+        db=db,
     )