feat: CalDAV write-back — push local event create/update/delete to the remote (#800) (#1282)

* feat: CalDAV write-back — push local event create/update/delete to the remote (#800)

CalDAV sync was pull-only (src/caldav_sync.py), so events created, edited, or
deleted in Odysseus on a CalDAV-backed calendar only changed local SQLite and
never reached the server — they silently vanished on the next pull and never
appeared on the user's phone (iCloud, etc.).

This adds the missing write half:
- src/caldav_writeback.py builds the VEVENT, re-discovers the remote calendar by
  the same URL-hash the local id was derived from (the remote URL isn't stored),
  and PUTs/DELETEs the event by UID via the caldav lib. The pure pieces
  (build_event_ical, find_remote_calendar, push_event) take inputs by argument so
  they unit-test against a fake client with no network.
- create/update/delete event handlers (routes/calendar_routes.py) call it
  best-effort for caldav-sourced calendars only: the local DB stays the source of
  truth, a remote failure is logged, never fatal, and local calendars are untouched.

Tests: tests/test_caldav_writeback.py (9, pure logic incl. iCal serialization,
hash discovery, create/update/delete orchestration) and
tests/test_caldav_writeback_route.py (3, route-level: a caldav calendar pushes,
a local one does not, delete pushes a delete). 12 passed.

Note: write-back re-discovers the remote calendar per write (the URL isn't
persisted locally); a follow-up could cache it. Live-iCloud verification needs a
real account — flagging for a maintainer pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: drive #800 route regression without TestClient (fixes local hang)

Same fix as the document route test: the CalDAV write-back route regression used
Starlette TestClient (middleware app + threadpool) which hung in the maintainer's
environment. Rework it to call the async create/delete calendar handlers directly
— extracted from the router — with a minimal fake request, temp-SQLite-patched
SessionLocal, and writeback_event stubbed to record calls. Same coverage (a
caldav calendar pushes, a local one does not, delete pushes a delete), completes
in ~0.3s with no TestClient.

Verified the maintainer's exact batch:
  pytest tests/test_caldav_writeback.py tests/test_caldav_writeback_route.py -> 12 passed

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_caldav_writeback.py

@@ -0,0 +1,118 @@
+"""Issue #800 — CalDAV write-back pushes local changes to the remote server.
+
+Unit-tests the pure pieces against a fake caldav calendar (no network): the
+iCalendar serialization, hash-based remote-calendar discovery, and the
+create/update/delete orchestration.
+"""
+
+from datetime import datetime
+
+from src.caldav_writeback import (
+    build_event_ical,
+    find_remote_calendar,
+    push_event,
+    _stable_cal_id,
+)
+
+REMOTE_URL = "https://p69-caldav.icloud.com/123/calendars/home/"
+CAL_ID = _stable_cal_id(REMOTE_URL)
+
+
+class FakeEvent:
+    def __init__(self):
+        self.data = "OLD"
+        self.saved = False
+        self.deleted = False
+
+    def save(self):
+        self.saved = True
+
+    def delete(self):
+        self.deleted = True
+
+
+class FakeCalendar:
+    def __init__(self, url, existing=None):
+        self.url = url
+        self._existing = existing
+        self.saved_ical = None
+
+    def event_by_uid(self, uid):
+        if self._existing is None:
+            raise Exception("not found")
+        return self._existing
+
+    def save_event(self, ical):
+        self.saved_ical = ical
+
+
+def _ev(**over):
+    base = dict(
+        uid="evt-1", summary="Dentist", description="bring x-rays",
+        location="Clinic", dtstart=datetime(2026, 6, 10, 14, 0),
+        dtend=datetime(2026, 6, 10, 15, 0), all_day=False, is_utc=True, rrule="",
+    )
+    base.update(over)
+    return base
+
+
+def test_build_ical_timed_event_has_core_fields():
+    ical = build_event_ical(_ev())
+    assert "BEGIN:VEVENT" in ical and "END:VEVENT" in ical
+    assert "UID:evt-1" in ical
+    assert "SUMMARY:Dentist" in ical
+    # is_utc -> UTC instant (Z suffix)
+    assert "DTSTART:20260610T140000Z" in ical
+    assert "DTEND:20260610T150000Z" in ical
+
+
+def test_build_ical_all_day_uses_date_values():
+    ical = build_event_ical(_ev(all_day=True, is_utc=False))
+    assert "DTSTART;VALUE=DATE:20260610" in ical
+
+
+def test_build_ical_includes_rrule():
+    ical = build_event_ical(_ev(rrule="FREQ=WEEKLY;BYDAY=MO"))
+    assert "RRULE:FREQ=WEEKLY" in ical
+
+
+def test_find_remote_calendar_matches_by_hash():
+    cals = [FakeCalendar("https://other/x/"), FakeCalendar(REMOTE_URL)]
+    found = find_remote_calendar(cals, CAL_ID)
+    assert found is cals[1]
+    assert find_remote_calendar([FakeCalendar("https://nope/")], CAL_ID) is None
+
+
+def test_push_create_calls_save_event():
+    cal = FakeCalendar(REMOTE_URL, existing=None)  # event_by_uid raises -> create
+    res = push_event([cal], CAL_ID, _ev(), delete=False)
+    assert res["ok"] and res.get("created")
+    assert cal.saved_ical and "UID:evt-1" in cal.saved_ical
+
+
+def test_push_update_overwrites_existing():
+    existing = FakeEvent()
+    cal = FakeCalendar(REMOTE_URL, existing=existing)
+    res = push_event([cal], CAL_ID, _ev(summary="Moved"), delete=False)
+    assert res["ok"] and res.get("updated")
+    assert existing.saved and "SUMMARY:Moved" in existing.data
+    assert cal.saved_ical is None  # used update path, not create
+
+
+def test_push_delete_removes_existing():
+    existing = FakeEvent()
+    cal = FakeCalendar(REMOTE_URL, existing=existing)
+    res = push_event([cal], CAL_ID, _ev(), delete=True)
+    assert res["ok"] and existing.deleted
+
+
+def test_push_delete_absent_is_ok():
+    cal = FakeCalendar(REMOTE_URL, existing=None)
+    res = push_event([cal], CAL_ID, _ev(), delete=True)
+    assert res["ok"] and "absent" in res.get("note", "")
+
+
+def test_push_unknown_calendar_reports_not_found():
+    cal = FakeCalendar("https://different/")
+    res = push_event([cal], CAL_ID, _ev())
+    assert res["ok"] is False and "not found" in res["error"]

tests/test_caldav_writeback_route.py

@@ -0,0 +1,103 @@
+"""Issue #800 — the calendar write handlers actually trigger CalDAV write-back.
+
+Route-level: proves POST/DELETE /api/calendar/events fire writeback_event for a
+CalDAV-backed calendar and not for a local one.
+
+Calls the async route handlers DIRECTLY (extracted from the router) rather than
+through Starlette's TestClient — the TestClient middleware-app + threadpool could
+hang in some environments; a direct call with a minimal fake request keeps the
+same coverage and completes reliably.
+"""
+
+import tempfile
+import uuid
+from types import SimpleNamespace
+
+import pytest
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy.pool import NullPool
+
+import core.database as cdb
+import routes.calendar_routes as croutes
+import src.caldav_writeback as wb
+from core.database import CalendarCal
+from routes.calendar_routes import EventCreate
+
+_TMPDB = tempfile.NamedTemporaryFile(suffix=".db", delete=False)
+_ENGINE = create_engine(
+    f"sqlite:///{_TMPDB.name}",
+    connect_args={"check_same_thread": False},
+    poolclass=NullPool,
+)
+cdb.Base.metadata.create_all(_ENGINE)
+_TS = sessionmaker(bind=_ENGINE, autoflush=False, autocommit=False)
+croutes.SessionLocal = _TS
+
+
+@pytest.fixture
+def calls(monkeypatch):
+    recorded = []
+
+    async def _fake_writeback(owner, source, cal_id, ev, *, delete=False):
+        recorded.append({"source": source, "cal_id": cal_id, "uid": ev.get("uid"), "delete": delete})
+        return {"ok": True}
+
+    monkeypatch.setattr(wb, "writeback_event", _fake_writeback)
+    return recorded
+
+
+def _req():
+    return SimpleNamespace(state=SimpleNamespace(current_user="tester"))
+
+
+def _endpoint(method, suffix):
+    router = croutes.setup_calendar_routes()
+    for r in router.routes:
+        if getattr(r, "path", "").endswith(suffix) and method in getattr(r, "methods", set()):
+            return r.endpoint
+    raise RuntimeError(f"{method} *{suffix} not found")
+
+
+def _make_cal(source):
+    cid = ("caldav-" if source == "caldav" else "loc-") + uuid.uuid4().hex[:10]
+    db = _TS()
+    try:
+        db.add(CalendarCal(id=cid, owner="tester", name="C", source=source))
+        db.commit()
+        return cid
+    finally:
+        db.close()
+
+
+async def test_create_on_caldav_calendar_pushes_to_remote(calls):
+    create_event = _endpoint("POST", "/events")
+    cal_id = _make_cal("caldav")
+    res = await create_event(_req(), EventCreate(
+        summary="Dentist", dtstart="2026-06-10T14:00:00Z", calendar_href=cal_id))
+    assert res["ok"] is True
+    assert len(calls) == 1
+    assert calls[0]["source"] == "caldav" and calls[0]["cal_id"] == cal_id
+    assert calls[0]["delete"] is False
+
+
+async def test_create_on_local_calendar_does_not_push(calls):
+    create_event = _endpoint("POST", "/events")
+    cal_id = _make_cal("local")
+    res = await create_event(_req(), EventCreate(
+        summary="Local", dtstart="2026-06-10T14:00:00Z", calendar_href=cal_id))
+    assert res["ok"] is True
+    assert calls == []
+
+
+async def test_delete_on_caldav_calendar_pushes_delete(calls):
+    create_event = _endpoint("POST", "/events")
+    delete_event = _endpoint("DELETE", "/events/{uid}")
+    cal_id = _make_cal("caldav")
+    res = await create_event(_req(), EventCreate(
+        summary="Temp", dtstart="2026-06-10T14:00:00Z", calendar_href=cal_id))
+    uid = res["uid"]
+    calls.clear()
+    rd = await delete_event(_req(), uid)
+    assert rd["ok"] is True
+    assert len(calls) == 1 and calls[0]["delete"] is True and calls[0]["uid"] == uid