luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

style(13-03): apply Prettier formatting across repo

Browse Source 
Mechanical reformat — no logic changes. 398 files changed, 19125
insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc
(singleQuote:true, semi:true, tabWidth:2, trailingComma:all,
printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/milestones/v1.0-phases/03-event-write-back-pwa-install/03-02-PLAN.md
+28 -25
View File
@@ -3,7 +3,7 @@ phase: 03-event-write-back-pwa-install
plan: 02
type: tdd
wave: 2
depends_on: ["03-01"]
depends_on: ['03-01']
files_modified:
- apps/api/src/broker/vevent.ts
- apps/api/src/broker/write.ts
@@ -15,26 +15,26 @@ user_setup: []
must_haves:
truths:
- "buildVeventString produces a valid VCALENDAR/VEVENT for timed, all-day, and recurring events"
- "All-day events serialize as DATE (no time component, no TZID) per D-13 — never coerced to DATETIME"
- "createCalendarEvent / updateCalendarEvent / deleteCalendarEvent route all Fastmail writes through tsdav with correct If-Match/If-None-Match"
- 'buildVeventString produces a valid VCALENDAR/VEVENT for timed, all-day, and recurring events'
- 'All-day events serialize as DATE (no time component, no TZID) per D-13 — never coerced to DATETIME'
- 'createCalendarEvent / updateCalendarEvent / deleteCalendarEvent route all Fastmail writes through tsdav with correct If-Match/If-None-Match'
artifacts:
- path: "apps/api/src/broker/vevent.ts"
provides: "buildVeventString(NewEventParams) → { uid, icsString }"
exports: ["buildVeventString", "NewEventParams", "RRULE_PRESETS"]
- path: 'apps/api/src/broker/vevent.ts'
provides: 'buildVeventString(NewEventParams) → { uid, icsString }'
exports: ['buildVeventString', 'NewEventParams', 'RRULE_PRESETS']
min_lines: 40
- path: "apps/api/src/broker/write.ts"
provides: "tsdav PUT/DELETE wrappers (broker boundary, D-12)"
exports: ["createCalendarEvent", "updateCalendarEvent", "deleteCalendarEvent"]
- path: 'apps/api/src/broker/write.ts'
provides: 'tsdav PUT/DELETE wrappers (broker boundary, D-12)'
exports: ['createCalendarEvent', 'updateCalendarEvent', 'deleteCalendarEvent']
key_links:
- from: "apps/api/src/broker/vevent.ts"
to: "ical.js ICAL.Component / ICAL.Time"
via: "VEVENT construction"
- from: 'apps/api/src/broker/vevent.ts'
to: 'ical.js ICAL.Component / ICAL.Time'
via: 'VEVENT construction'
pattern: "ICAL\\.(Component|Time)"
- from: "apps/api/src/broker/write.ts"
to: "tsdav createCalendarObject/updateCalendarObject/deleteCalendarObject"
via: "FastmailClient methods"
pattern: "(create|update|delete)CalendarObject"
- from: 'apps/api/src/broker/write.ts'
to: 'tsdav createCalendarObject/updateCalendarObject/deleteCalendarObject'
via: 'FastmailClient methods'
pattern: '(create|update|delete)CalendarObject'
---
<objective>
@@ -129,19 +129,21 @@ Output: `vevent.ts`, `write.ts`, both GREEN against their Plan 01 test files.
</tasks>
<threat_model>
## Trust Boundaries
| Boundary | Description |
|----------|-------------|
| Boundary | Description |
| ------------------------ | -------------------------------------------------- |
| broker → Fastmail CalDAV | Only write.ts issues PUT/DELETE to Fastmail (D-12) |
## STRIDE Threat Register
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|-----------|----------|-----------|-------------|-----------------|
| T-03-03 | Tampering | VEVENT field serialization (summary/location/description with special chars) | mitigate | ical.js ICAL.Component handles line-folding + escaping (commas, semicolons, newlines); never hand-roll ICS strings (RESEARCH §Don't Hand-Roll) |
| T-03-04 | Spoofing | etag forgery to bypass conflict detection | mitigate | etag is sourced server-side (calendarEvents.etag) by the worker, never accepted from the browser; write.ts only forwards what the server supplies |
| T-03-05 | Elevation of Privilege | write.ts called with another member's calendar | accept (here) | Calendar ownership is enforced at the route layer (Plan 04, V4); write.ts is a low-level primitive with no auth context |
| Threat ID | Category | Component | Disposition | Mitigation Plan |
| --------- | ---------------------- | ---------------------------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| T-03-03 | Tampering | VEVENT field serialization (summary/location/description with special chars) | mitigate | ical.js ICAL.Component handles line-folding + escaping (commas, semicolons, newlines); never hand-roll ICS strings (RESEARCH §Don't Hand-Roll) |
| T-03-04 | Spoofing | etag forgery to bypass conflict detection | mitigate | etag is sourced server-side (calendarEvents.etag) by the worker, never accepted from the browser; write.ts only forwards what the server supplies |
| T-03-05 | Elevation of Privilege | write.ts called with another member's calendar | accept (here) | Calendar ownership is enforced at the route layer (Plan 04, V4); write.ts is a low-level primitive with no auth context |
</threat_model>
<verification>
@@ -151,9 +153,10 @@ Output: `vevent.ts`, `write.ts`, both GREEN against their Plan 01 test files.
</verification>
<success_criteria>
- VEVENT builder correct for timed, all-day (DATE), and recurring events.
- tsdav write wrappers enforce the broker boundary with correct If-Match/filename wiring.
</success_criteria>
</success_criteria>
<output>
Create `.planning/phases/03-event-write-back-pwa-install/03-02-SUMMARY.md` when done.