BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
nidusctl user create <username>
nidusctl calendar create <username> <name>
nidusctl addressbook create <username> <name>
- internal/db: new users, calendars, addressbooks tables with FK cascade
delete; foreign_keys pragma enabled; internal/db/users.go implements
full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
create/delete handlers for calendars/address books at
/web/resources/{calendar,addressbook}; dashboard gained create forms
and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
interactive password prompt via golang.org/x/term) plus create/delete/
list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
new nidusctl commands and the DB-backed architecture.
Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Root handler now only serves the welcome page for GET/HEAD; all other
methods (e.g. OPTIONS, PROPFIND) return 405 with an Allow header instead
of always returning 200, fixing client capability probes and PROPFIND
misbehavior.
- Mount /files/ properly and cache one xwebdav.Handler per authenticated
user so its LockSystem persists across requests instead of being
recreated per-request (which broke LOCK/UNLOCK).
- Remove the username segment from all DAV URLs (/cal/, /card/, /files/
are now identical for every account; the acting user is always resolved
via Basic Auth, never the path).
- Reintroduce a fixed literal "home" path segment (/cal/home/,
/card/home/) to preserve the URL segment depth that go-webdav's
caldav/carddav server relies on to classify resources (principal vs.
home-set vs. collection vs. object). Removing the username had
collapsed this depth, silently misclassifying requests and returning
empty <multistatus> responses (DAVx5 "no resources found").
- Replace the store's single global mutex with per-user sharded locks so
different users' requests no longer serialize against each other.
- Add auth.NewContext test helper, WebDAV handler tests
(per-user isolation, lock persistence across requests), and a
concurrent multi-user store test.
- Update README and copilot-instructions to document the new URL scheme
and the go-webdav path-depth classification quirk.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
arnef
