Class WebDavClient

packages/core/src/sync/webdav-client.ts:236–695

}

export class WebDavClient {
  private baseUrl: string;
  private authHeader: string;
  private allowInsecure: boolean;
  /**
   * Flips to true after the first 2xx/207 response. Once true, a 401 is
   * treated as a server-side throttle (retry-worthy) rather than a credential
   * failure. Reset per WebDavClient instance.
   */
  private hadAuthSuccess = false;

  constructor(url: string, username: string, password: string, allowInsecure?: boolean) {
    // Normalize: remove control chars/whitespace and trailing slash
    this.baseUrl = sanitizeWebDavUrl(url);
    // Basic auth header
    const credentials = `${username}:${password}`;
    // Use UTF-8 safe base64 encoding; btoa is unreliable in React Native/Android.
    const encoded = Buffer.from(credentials, "utf8").toString("base64");
    this.authHeader = `Basic ${encoded}`;
    console.log("[WebDAV] auth configured", {
      username: username.length > 2 ? `${username[0]}***${username[username.length - 1]}` : "***",
      passwordLength: password.length,
    });
    this.allowInsecure = allowInsecure ?? false;
  }

  private getTimeout(method: string, explicitTimeoutMs?: number): number {
    if (explicitTimeoutMs !== undefined) return explicitTimeoutMs;
    const isTransferOperation = method === "PUT" || method === "GET";
    return isTransferOperation ? TRANSFER_TIMEOUT_MS : DEFAULT_TIMEOUT_MS;
  }

  private buildUrl(path: string): string {
    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
    // Encode path segments but preserve /
    const encoded = normalizedPath
      .split("/")
      .map((segment) => encodeURIComponent(segment))
      .join("/");
    return `${this.baseUrl}${encoded}`;
  }

  private getAuthHeaders(): Record<string, string> {
    return { Authorization: this.authHeader };
  }

  /** True if the status code indicates a transient, retry-worthy failure. */
  private isTransientStatus(status: number): boolean {
    // 401 BEFORE any successful auth = real credential failure, do not retry.
    // 401 AFTER a successful response = server is throttling / temporarily
    // rejecting valid credentials under burst load (Jianguoyun, some NAS).
    if (status === 401 && this.hadAuthSuccess) return true;
    if (status === 429) return true;
    if (status >= 500 && status < 600) return true;
    return false;
  }

  private async doFetch(