github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 19:47:47 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2484] [MERGED] feat: allow API tokens with caldav permission for CalDAV auth #5668

New Issue
Closed
opened 2026-04-16 13:47:55 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-16 13:47:55 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2484
Author: @tink-bot
Created: 3/26/2026
Status: ✅ Merged
Merged: 3/30/2026
Merged by: @kolaente

Base: main ← Head: feat-caldav-api-tokens

📝 Commits (7)

  • 0f57db6 feat: register caldav permission group for API tokens
  • 6d50802 feat: add HasCaldavAccess method to APIToken
  • 7fcb49e feat: accept API tokens for CalDAV basic auth
  • 7ed105d test: add integration tests for CalDAV API token auth
  • 8ae9142 test: verify caldav permission group appears in /routes
  • f7aef5a feat: add API token hint to CalDAV settings page
  • 4e686f5 refactor: extract shared API token validation into ValidateTokenAndGetOwner

📊 Changes

10 files changed (+212 additions, -16 deletions)

View changed files

📝 frontend/src/i18n/lang/en.json (+2 -1)
📝 frontend/src/views/user/settings/Caldav.vue (+13 -0)
📝 pkg/db/fixtures/api_tokens.yml (+20 -0)
📝 pkg/models/api_routes.go (+6 -0)
📝 pkg/models/api_tokens.go (+40 -0)
📝 pkg/models/api_tokens_test.go (+30 -0)
📝 pkg/routes/api_tokens.go (+3 -15)
📝 pkg/routes/caldav/auth.go (+39 -0)
📝 pkg/webtests/api_tokens_test.go (+21 -0)
📝 pkg/webtests/caldav_test.go (+38 -0)

📄 Description

Allow API tokens with a caldav permission to authenticate CalDAV requests via HTTP Basic Auth, so users can use a single token type instead of needing separate CalDAV-specific tokens.

When a CalDAV Basic Auth password starts with tk_, it is validated as an API token with caldav:access permission. The tk_ prefix is unambiguous, so invalid API tokens fail fast without falling through to password/CalDAV-token auth. Existing CalDAV tokens and password auth continue to work unchanged.

The frontend CalDAV settings page now mentions API tokens as an alternative and links to the API token settings.

Test plan

  • Verify CalDAV client authentication works with an API token that has caldav:access permission
  • Verify CalDAV client authentication is rejected for API tokens without caldav permission
  • Verify existing CalDAV token and password auth still work

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2484 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/26/2026 **Status:** ✅ Merged **Merged:** 3/30/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `feat-caldav-api-tokens` --- ### 📝 Commits (7) - [`0f57db6`](https://github.com/go-vikunja/vikunja/commit/0f57db667dbbec4659abc829d8bbf8fa6fd1a5c1) feat: register caldav permission group for API tokens - [`6d50802`](https://github.com/go-vikunja/vikunja/commit/6d508023cf843775786c76a2dbf0ee4ea491ca11) feat: add HasCaldavAccess method to APIToken - [`7fcb49e`](https://github.com/go-vikunja/vikunja/commit/7fcb49ed90e2c1b02c425cc241112a6e84b1e5eb) feat: accept API tokens for CalDAV basic auth - [`7ed105d`](https://github.com/go-vikunja/vikunja/commit/7ed105d695678d5b5d57188852ddf2df4d6964eb) test: add integration tests for CalDAV API token auth - [`8ae9142`](https://github.com/go-vikunja/vikunja/commit/8ae914219a24d821e50362f0fba6d5500dc6f6f8) test: verify caldav permission group appears in /routes - [`f7aef5a`](https://github.com/go-vikunja/vikunja/commit/f7aef5a399c01022f8669eda6f7c568827ea0fa7) feat: add API token hint to CalDAV settings page - [`4e686f5`](https://github.com/go-vikunja/vikunja/commit/4e686f518dcbd69311ec3cdc74b4236bf99ee7a7) refactor: extract shared API token validation into ValidateTokenAndGetOwner ### 📊 Changes **10 files changed** (+212 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `frontend/src/i18n/lang/en.json` (+2 -1) 📝 `frontend/src/views/user/settings/Caldav.vue` (+13 -0) 📝 `pkg/db/fixtures/api_tokens.yml` (+20 -0) 📝 `pkg/models/api_routes.go` (+6 -0) 📝 `pkg/models/api_tokens.go` (+40 -0) 📝 `pkg/models/api_tokens_test.go` (+30 -0) 📝 `pkg/routes/api_tokens.go` (+3 -15) 📝 `pkg/routes/caldav/auth.go` (+39 -0) 📝 `pkg/webtests/api_tokens_test.go` (+21 -0) 📝 `pkg/webtests/caldav_test.go` (+38 -0) </details> ### 📄 Description Allow API tokens with a `caldav` permission to authenticate CalDAV requests via HTTP Basic Auth, so users can use a single token type instead of needing separate CalDAV-specific tokens. When a CalDAV Basic Auth password starts with `tk_`, it is validated as an API token with `caldav:access` permission. The `tk_` prefix is unambiguous, so invalid API tokens fail fast without falling through to password/CalDAV-token auth. Existing CalDAV tokens and password auth continue to work unchanged. The frontend CalDAV settings page now mentions API tokens as an alternative and links to the API token settings. ## Test plan - Verify CalDAV client authentication works with an API token that has `caldav:access` permission - Verify CalDAV client authentication is rejected for API tokens without `caldav` permission - Verify existing CalDAV token and password auth still work --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-16 13:47:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#5668
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?