chore

Author: tchapi

src/Entity/User.php

@@ -20,9 +20,11 @@ class User
 
     /**
      * A username ends up in the principal URI (`principals/<username>`), so it must not carry
-     * anything that would change that path's structure. Letters, digits and `_ . @ + ' -` are allowed:
-     * the punctuation is what shows up in mail-derived login names. Enforced when a user is created; existing
-     * accounts are left alone so that an odd username created before this rule stays editable.
+     * anything that would change that path's structure. Letters, digits and `_ . @ + ' -` are
+     * allowed: the punctuation is what shows up in mail-derived login names.
+     *
+     * Only checked in the `creation` validation group, so that an account whose name does not
+     * match — an LDAP or IMAP login, say — stays editable.
      */
     public const USERNAME_PATTERN = '/^[a-zA-Z0-9_.@+\'-]+$/';
 

src/Plugins/DavisIMipPlugin.php

@@ -230,12 +230,10 @@ public function schedule(ITip\Message $itip)
             ->replyTo(new Address($senderEmail, $mailSenderName))
             ->subject($subject);
 
-        // Keep holiday auto-replies from bouncing back at invitations. This used to sit behind
-        // the version check, so disabling that would have silently dropped it too.
+        // Keep holiday auto-replies from bouncing back at invitations.
         $message->getHeaders()->addTextHeader('X-Auto-Response-Suppress', 'OOF, DR, RN, NRN, AutoReply');
 
         if (DAV\Server::$exposeVersion) {
-            // NB: the header name carried a trailing ": " here, which is not a valid name
             $message->getHeaders()->addTextHeader('X-Sabre-Version', DAV\Version::VERSION);
         }
 

tests/Functional/AddressBookDavTest.php

@@ -44,8 +44,7 @@ private function addressBookFor(string $uri): array
     }
 
     /**
-     * Regression test for issue #275: a display name is optional in CardDAV, but the column
-     * was NOT NULL, so an MKCOL without {DAV:}displayname failed with a 500.
+     * A display name is optional in CardDAV: an MKCOL without {DAV:}displayname must succeed.
      */
     public function testAddressBookCanBeCreatedWithoutADisplayName(): void
     {

tests/Functional/CalendarSubscriptionTest.php

@@ -45,9 +45,8 @@ private function subscriptionFor(string $uri): array
     }
 
     /**
-     * Regression test: `calendarorder` had no default, and sabre only lists it in its INSERT
-     * when the client sent {http://apple.com/ns/ical/}calendar-order. Subscribing without one
-     * therefore failed with a NOT NULL violation.
+     * sabre only lists `calendarorder` in its INSERT when the client sent
+     * {http://apple.com/ns/ical/}calendar-order, so the column needs a default.
      */
     public function testSubscriptionCanBeCreatedWithoutACalendarOrder(): void
     {

tests/Functional/Controllers/DashboardTest.php

@@ -94,7 +94,7 @@ public function testLoginCorrect(): void
     }
 
     /**
-     * A plain `GET /logout` from any page the admin happens to visit used to end their session.
+     * Logging out is a state change: a bare `GET /logout` must not end the session.
      */
     public function testLogoutRequiresACsrfToken(): void
     {

tests/Functional/DavTest.php

@@ -129,8 +129,8 @@ public function testAnonymousCannotReadCalendarObject(): void
     }
 
     /**
-     * Regression test: the ACL plugin used to skip all privilege checks whenever
-     * `sabreAction=asset` was present in the query string, for any method and any path.
+     * `sabreAction=asset` is only meaningful for the browser plugin's own assets: it must not
+     * waive the privilege checks on an arbitrary path.
      */
     public function testAssetQueryParameterDoesNotBypassReadAcl(): void
     {
@@ -208,8 +208,8 @@ public function testWellKnownUrlsRedirectToTheDavEndpoint(): void
     }
 
     /**
-     * OPTIONS used to answer for the server root whatever was asked, so it never advertised
-     * the methods that only exist deeper in the tree, MKCALENDAR being the obvious one.
+     * The advertised methods depend on the node: MKCALENDAR only exists inside a calendar home,
+     * so OPTIONS has to answer for the path it was asked about rather than for the root.
      */
     public function testOptionsDescribesTheRequestedPath(): void
     {

tests/Functional/Service/LDAPAuthTest.php

@@ -63,8 +63,7 @@ public function testDomainComponentsAreAvailableInReverseOrder(): void
     }
 
     /**
-     * Regression test: the username was interpolated into the DN pattern verbatim, so a name
-     * carrying DN syntax added structure to the DN instead of being a value inside it.
+     * A username carrying DN syntax must stay a value inside the DN, not add structure to it.
      */
     public function testAUsernameCannotInjectDnStructure(): void
     {

tests/Functional/SyncTokenTest.php

@@ -50,10 +50,8 @@ private function createAddressBookAtTokenEleven(): int
     }
 
     /**
-     * Regression test: sync tokens were stored as text, so `synctoken >= 9 AND synctoken < 11`
-     * was compared lexicographically ('10' sorts before '9'). A client syncing across a
-     * decimal-width boundary was told the collection had advanced but received no changes at
-     * all, silently losing contacts.
+     * Sync tokens are compared numerically, so a client syncing across a decimal-width
+     * boundary gets every change in the range. Compared as text, `'10' < '9'` would hide them.
      */
     public function testChangesAcrossADecimalBoundaryAreReported(): void
     {