fix(dav): harden authorization and bounded PROPFIND semantics - #1645

Draft

seonghobae wants to merge 93 commits into

fix/email-shared-send-rate-limitfrom

fix/dav-single-decode-1344

Commits on Sep 10, 2026

experiment: bound send throttle scopes with expired eviction
seonghobae
committed
b39a4b8
experiment: lock send throttle window expiry with regression test
seonghobae
committed
1c5049c
experiment: format own expiry lines to ruff style
seonghobae
committed
23fa8f7
experiment: lock org-scope isolation for send throttle
seonghobae
committed
1fcd8b5
experiment: lock concurrent burst atomicity for send throttle
seonghobae
committed
f7390a3
chore(email): reconcile process-local throttle proposal under shared owner
seonghobae
committed
624ab25
experiment: RED nested-encoding rejection for DAV auth path (#1344)
seonghobae
committed
7825933
experiment: GREEN single-decode DAV auth path with nested rejection (#1344)
seonghobae
committed
0bdaf4f
test(dav): RED framework decode boundary and percent-data cases (#1344)
seonghobae
committed
c919883
fix(dav): honor framework decode boundary and validate raw target (#1344)
seonghobae
committed
eafcc8d
test(dav): RED missing-raw-path percent fallback (#1344)
seonghobae
committed
b6931bf
fix(dav): fail closed when raw percent provenance is unavailable (#1344)
seonghobae
committed
42b5af3
docs(dav): trace authorization decode boundary and evidence (#1344)
seonghobae
committed
5506884
test(dav): RED split-encoded nested percent sequences (#1344)
seonghobae
committed
9a294e3
fix(dav): detect second-pass escapes after one wire decode (#1344)
seonghobae
committed
1df3aa4
docs(dav): record split-encoding RED and causal repair (#1344)
seonghobae
committed
8139be8
test(dav): RED decoded C1 control characters (#1344)
seonghobae
committed
f5fd8a4
fix(dav): reject decoded Unicode control characters (#1344)
seonghobae
committed
9d0d3af
test(dav): enforce pre-log control rejection after C1 fix (#1344)
seonghobae
committed
dcdd606
docs(dav): record decoded-control review repair (#1344)
seonghobae
committed
9edf307
test(dav): cover percent-free missing-raw-path fallback (#1344)
seonghobae
committed
f29706f
docs(dav): record missing-raw-path positive acceptance (#1344)
seonghobae
committed
8e6acc7
test(dav): reject unsupported capability advertisement (#1344)
seonghobae
committed
2b55a02
fix(dav): advertise only implemented capabilities (#1344)
seonghobae
committed
6a565ed
test(dav): align discovery assertions with operational surface (#1344)
seonghobae
committed
0990d0f
test(dav): fold capability regression into owned suite (#1344)
seonghobae
committed
25531c0
docs(dav): record truthful capability discovery boundary (#1344)
seonghobae
committed
50bd004
docs(dav): trace CalDAV and CardDAV capability tokens (#1344)
seonghobae
committed
cc4838f
docs(dav): distinguish registered from advertised methods (#1344)
seonghobae
committed
4079fc8
test(dav): preserve canonical path and request bounds (#1344)
seonghobae
committed
68ce68a
test(dav): isolate canonical path RED (#1344)
seonghobae
committed
b2eb1fe
fix(dav): propagate canonical path and bound request work (#1344)
seonghobae
committed
cff6e61
docs(dav): record predecessor succession and URI bounds (#1344)
seonghobae
committed
a000037
test(dav): reject unsupported PUT before body read
seonghobae
committed
fe678f6
fix(dav): reject unsupported PUT before reading body
seonghobae
committed
90ba3d9
docs(dav): trace unsupported PUT body boundary
seonghobae
committed
4709189
test(dav): expose PROPFIND depth coercion
seonghobae
committed
e0e1469
fix(dav): enforce finite PROPFIND depth semantics
seonghobae
committed
377693c
test(dav): make finite PROPFIND depth explicit
seonghobae
committed
0dc0db0
test(dav): preserve explicit depth in canonical route regression
seonghobae
committed
a32d65d
docs(dav): record finite PROPFIND depth boundary
seonghobae
committed
5d1f2c8
test(dav): cover depth-zero collection semantics
seonghobae
committed
71b9d04
docs(dav): trace depth-zero acceptance evidence
seonghobae
committed
bcdebd8
test(dav): require Depth 1 to include collection resource
seonghobae
committed
268a41a
fix(dav): include target collection in Depth 1 response
seonghobae
committed
e966609
docs(dav): trace Depth 1 target-and-member contract
seonghobae
committed
aec5151
test(dav): reproduce unbounded depth-one member materialization
seonghobae
committed
facfdcc
fix(webdav): allow bounded project-folder reads
seonghobae
committed
b784ce9
fix(dav): bound depth-one project member materialization
seonghobae
committed
093e748
test(dav): keep stubs aligned with bounded folder reads
seonghobae
committed
e281993
test(webdav): verify bounded folder query reaches SQL
seonghobae
committed
18b1bd7
docs(dav): trace bounded depth-one member policy
seonghobae
committed
3411565
test(dav): lock the 256-member boundary
seonghobae
committed
ecbe3c1
test(dav): make PROPFIND body semantics executable RED
seonghobae
committed
bad0f67
fix(dav): validate bounded PROPFIND request bodies
seonghobae
committed
56a77d1
test(dav): cover PROPFIND XML directive boundaries
seonghobae
committed
27b909f
docs(dav): trace PROPFIND body semantics and bounds
seonghobae
committed
847e51b
fix(dav): keep XML parse errors on defused boundary
seonghobae
committed
79722fe
test(dav): make PROPFIND element-content finding RED
seonghobae
committed
55f8f14
fix(dav): enforce element-only PROPFIND grammar
seonghobae
committed
1c133f6
docs(dav): trace PROPFIND grammar review repairs
seonghobae
committed
d2e192e
test(dav): make invalid allprop include grammar RED
seonghobae
committed
cb19cb3
fix(dav): validate allprop before include refusal
seonghobae
committed
a4429f9
docs(dav): trace allprop include grammar repair
seonghobae
committed
8f1b146
test(dav): reject property values before unsupported PROPFIND modes
seonghobae
committed
d6385bd
fix(dav): validate property-name grammar before PROPFIND refusal
seonghobae
committed
fe275cb
docs(dav): trace property-name grammar repair
seonghobae
committed
f29325b
test(dav): distinguish XML whitespace from Unicode spaces
seonghobae
committed
e5a19a2
fix(dav): enforce XML S in element-only PROPFIND content
seonghobae
committed
39a3e05
docs(dav): trace XML whitespace grammar boundary
seonghobae
committed
8d504a6
test(dav): prove RFC XML extensibility semantics
seonghobae
committed
c0b154d
fix(dav): honor RFC XML extensibility rules
seonghobae
committed
8d6815d
fix(dav): preserve handler while applying XML extensibility
seonghobae
committed
db35735
test(dav): align EMPTY directives with RFC extensibility
seonghobae
committed
12cdf29
docs(dav): trace RFC XML extensibility repair
seonghobae
committed
df9d057
test(dav): require canonical collection hrefs
seonghobae
committed
ba992e3
fix(dav): canonicalize collection hrefs
seonghobae
committed
a755e45
docs(dav): trace collection URL canonicalization
seonghobae
committed
6b2f2be
test(dav): reject false project member enumeration
seonghobae
committed
3c1ba92
fix(dav): fail closed on unknown project members
seonghobae
committed
dbcad84
test(dav): keep property-only folder read at depth zero
seonghobae
committed
cf08479
test(dav): align path regressions with property-only reads
seonghobae
committed
8c794f1
docs(dav): trace direct project depth boundary
seonghobae
committed
eb9d94d
test(dav): restore finite-depth helper and positive folder read
seonghobae
committed
f574524
docs(dav): record depth harness repair
seonghobae
committed
3a89ec5
test(dav): align canonical-path probe with depth zero
seonghobae
committed
dd6ac12
docs(dav): record hosted depth regression repair
seonghobae
committed
aacaf2c

Commits on Sep 11, 2026

test(dav): reject collapsed empty path segments
seonghobae
committed
999d741
test(dav): cover leading empty path segment
seonghobae
committed
ce7ddd2
fix(dav): preserve empty path segment identity
seonghobae
committed
d2eb3dc
docs(dav): record empty-segment route boundary
seonghobae
committed
1a81509
fix(dav): preserve route-root slash while rejecting empty segments
seonghobae
committed
2b91bce
docs(dav): record empty-segment CI regression repair
seonghobae
committed
1e2827b