feat(calendar): groundwork for CalDAV calendar integration (1/4)

models/calendar/src/index.ts

@@ -18,6 +18,7 @@ import {
   type AccessLevel,
   calendarId,
   type PrimaryCalendar,
+  type CalDavCalendar,
   type Calendar,
   type CalendarEventPresenter,
   type Event,
@@ -45,6 +46,7 @@ import {
 import {
   ArrOf,
   Collection,
+  Hidden,
   Index,
   Mixin,
   Model,
@@ -70,6 +72,7 @@ import workbench from '@hcengineering/model-workbench'
 import { WidgetType } from '@hcengineering/workbench'
 import preference, { TPreference } from '@hcengineering/model-preference'
 import { calendarIntegrationKind } from '@hcengineering/calendar'
+import { getEmbeddedLabel } from '@hcengineering/platform'
 
 import calendar from './plugin'
 
@@ -98,6 +101,21 @@ export class TExternalCalendar extends TCalendar implements ExternalCalendar {
   externalUser!: string
 }
 
+@Mixin(calendar.mixin.CalDavCalendar, calendar.class.ExternalCalendar)
+export class TCalDavCalendar extends TExternalCalendar implements CalDavCalendar {
+  @Prop(TypeString(), getEmbeddedLabel('CalDAV account key'))
+  @Hidden()
+    accountKey!: string
+
+  @Prop(TypeString(), getEmbeddedLabel('CalDAV collection href'))
+  @Hidden()
+    href!: string
+
+  @Prop(TypeString(), getEmbeddedLabel('CalDAV collection ctag'))
+  @Hidden()
+    ctag?: string
+}
+
 @Model(calendar.class.Event, core.class.AttachedDoc, DOMAIN_EVENT)
 @UX(calendar.string.Event, calendar.icon.Calendar)
 export class TEvent extends TAttachedDoc implements Event {
@@ -200,6 +218,7 @@ export function createModel (builder: Builder): void {
   builder.createModel(
     TCalendar,
     TExternalCalendar,
+    TCalDavCalendar,
     TReccuringEvent,
     TReccuringInstance,
     TEvent,

packages/safe-fetch/.eslintrc.js

@@ -0,0 +1,7 @@
+module.exports = {
+  extends: ['./node_modules/@hcengineering/platform-rig/profiles/default/eslint.config.json'],
+  parserOptions: {
+    tsconfigRootDir: __dirname,
+    project: './tsconfig.json'
+  }
+}

packages/safe-fetch/README.md

@@ -0,0 +1,24 @@
+# @hcengineering/safe-fetch
+
+A `fetch` wrapper for services that request user-supplied URLs (link previews, CalDAV servers, webhooks).
+
+It blocks server-side request forgery by:
+
+- allowing only `https:` (and `http:` when explicitly enabled);
+- resolving every A and AAAA record of the hostname and rejecting the request when any address falls in a
+  private, loopback, link-local, multicast or otherwise reserved range;
+- pinning the TCP connection to the addresses that were checked, so a DNS answer cannot change between the
+  check and the connection;
+- validating every redirect hop the same way, dropping `Authorization` when the origin changes and switching
+  to `GET` where the HTTP specification requires it;
+- applying a timeout across the whole redirect chain and a cap on the response body size.
+
+Operators can allow specific hosts or CIDR ranges that would otherwise be blocked, for example a CalDAV server
+on a private network.
+
+```ts
+import { createSafeFetch } from '@hcengineering/safe-fetch'
+
+const fetch = createSafeFetch({ allowlist: ['caldav.internal.example', '10.20.0.0/16'] })
+const res = await fetch('https://caldav.internal.example/.well-known/caldav', { redirect: 'manual' })
+```

packages/safe-fetch/config/rig.json

@@ -0,0 +1,4 @@
+{  
+  "$schema": "https://developer.microsoft.com/json-schemas/rig-package/rig.schema.json",
+  "rigPackageName": "@hcengineering/platform-rig"
+}

packages/safe-fetch/jest.config.js

@@ -0,0 +1,7 @@
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  testMatch: ['**/?(*.)+(spec|test).[jt]s?(x)'],
+  roots: ["./src"],
+  coverageReporters: ["text-summary", "html"]
+}

packages/safe-fetch/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@hcengineering/safe-fetch",
+  "version": "0.7.0",
+  "main": "lib/index.js",
+  "svelte": "src/index.ts",
+  "types": "types/index.d.ts",
+  "files": [
+    "lib/**/*",
+    "types/**/*",
+    "tsconfig.json"
+  ],
+  "license": "EPL-2.0",
+  "scripts": {
+    "build": "compile",
+    "build:watch": "compile",
+    "format": "format src",
+    "test": "jest --passWithNoTests --silent",
+    "_phase:build": "compile transpile src",
+    "_phase:test": "jest --passWithNoTests --silent",
+    "_phase:format": "format src",
+    "_phase:validate": "compile validate"
+  },
+  "devDependencies": {
+    "@hcengineering/platform-rig": "workspace:^0.7.21",
+    "@types/jest": "^29.5.5",
+    "@types/node": "^24.13.3",
+    "@typescript-eslint/eslint-plugin": "^6.21.0",
+    "@typescript-eslint/parser": "^6.21.0",
+    "esbuild": "^0.25.10",
+    "eslint": "^8.54.0",
+    "eslint-config-standard-with-typescript": "^40.0.0",
+    "eslint-plugin-import": "^2.26.0",
+    "eslint-plugin-n": "^15.4.0",
+    "eslint-plugin-promise": "^6.1.1",
+    "jest": "^29.7.0",
+    "prettier": "^3.6.2",
+    "ts-jest": "^29.1.1",
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "ipaddr.js": "^2.2.0",
+    "undici": "^7.18.2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hcengineering/platform.git"
+  },
+  "exports": {
+    ".": {
+      "types": "./types/index.d.ts",
+      "require": "./lib/index.js",
+      "import": "./lib/index.js"
+    }
+  }
+}