fix(frontend): fix string encoding with login credentials (#253)

Author: ulfgebhardt

frontend/server/helpers/dav.spec.ts

@@ -215,6 +215,25 @@ describe('dav helpers', () => {
       expect(result).toBe(false)
     })
 
+    it('lowercases the email and requests a case-insensitive collation', async () => {
+      // The stored vCard EMAIL may be mixed-case and admin paths hand through raw
+      // input, so the filter must normalize the query and pin the collation rather
+      // than relying on the DAV server default (see findUserByEmail).
+      vi.mocked(addressBookQuery).mockResolvedValue([])
+      const account = createCardDAVAccount(config)
+      await findUserByEmail(account, 'Max@Example.COM')
+      const callArgs = vi.mocked(addressBookQuery).mock.calls[0]![0] as Record<string, unknown>
+      const filters = callArgs.filters as {
+        'prop-filter': {
+          _attributes: { name: string }
+          'text-match': { _attributes: { collation: string }; _text: string }
+        }
+      }
+      expect(filters['prop-filter']._attributes.name).toBe('EMAIL')
+      expect(filters['prop-filter']['text-match']._text).toBe('max@example.com')
+      expect(filters['prop-filter']['text-match']._attributes.collation).toBe('i;unicode-casemap')
+    })
+
     it('returns false when result has missing or empty addressData', async () => {
       // Hits the defensive `if (typeof data !== 'string' || data.length === 0)`
       // branch — Baikal can return a single hit but with no `address-data`
@@ -273,6 +292,21 @@ describe('dav helpers', () => {
       const result = await findUserByToken(account, 'bad-token')
       expect(result).toBe(false)
     })
+
+    it('matches the token exactly without a collation', async () => {
+      // Login tokens are high-entropy and case-sensitive: the filter must NOT relax
+      // matching with a collation the way the EMAIL lookup does.
+      vi.mocked(addressBookQuery).mockResolvedValue([])
+      const account = createCardDAVAccount(config)
+      await findUserByToken(account, 'AbC-ToKeN')
+      const callArgs = vi.mocked(addressBookQuery).mock.calls[0]![0] as Record<string, unknown>
+      const filters = callArgs.filters as {
+        'prop-filter': { _attributes: { name: string }; 'text-match': unknown }
+      }
+      expect(filters['prop-filter']._attributes.name).toBe(X_LOGIN_TOKEN)
+      // Plain string payload => no `collation` attribute, value passed verbatim.
+      expect(filters['prop-filter']['text-match']).toBe('AbC-ToKeN')
+    })
   })
 
   describe('saveUser', () => {

frontend/server/helpers/dav.ts

@@ -133,6 +133,12 @@ async function findUserByProperty(
   account: DAVAccount,
   propertyName: string,
   propertyValue: string,
+  // CardDAV text-match without an explicit collation falls back to the server
+  // default. RFC 6352 says that default is `i;unicode-casemap` (case-insensitive),
+  // but relying on the server to honor it is fragile. Pass a collation explicitly
+  // where case-insensitivity matters (e.g. EMAIL) and leave it undefined for
+  // high-entropy values (e.g. login tokens) that must match exactly.
+  collation?: string,
 ) {
   const users = await addressBookQuery({
     url: account.homeUrl!,
@@ -147,7 +153,9 @@ async function findUserByProperty(
         _attributes: {
           name: propertyName,
         },
-        ['text-match']: propertyValue,
+        ['text-match']: collation
+          ? { _attributes: { collation }, _text: propertyValue }
+          : propertyValue,
       },
     },
     fetchOptions: getFetchOptions(),
@@ -171,8 +179,11 @@ async function findUserByProperty(
 export const findUserByToken = async (account: DAVAccount, token: string) =>
   findUserByProperty(account, X_LOGIN_TOKEN, token)
 
+// Single choke-point for email normalization: callers may pass any casing
+// (admin endpoints/CLIs hand through raw input), so lowercase here and request a
+// case-insensitive match against the (possibly mixed-case) stored vCard EMAIL.
 export const findUserByEmail = async (account: DAVAccount, email: string) =>
-  findUserByProperty(account, 'EMAIL', email)
+  findUserByProperty(account, 'EMAIL', email.toLowerCase(), 'i;unicode-casemap')
 
 export const saveUser = async (account: DAVAccount, user: DAVResponse, vcard: ICAL.Component) =>
   updateVCard({