Use familiar HTTP file operations.

Confirm the supported scope

Daptin exposes WebDAV-style HTTP file operations for compatible storage workflows. Do not assume complete calendaring, contacts, locking, property, or desktop-client compatibility from the word WebDAV alone. Resolve the routes and methods exposed by the running release and test the exact client/version the product will use.

Prepare storage and access

1. Create the cloud/local store and the path the client should manage.
2. Create a disposable account with only the required record/storage permissions.
3. Protect the route with TLS before sending credentials over an untrusted network.
4. Record the base URL, authentication method, and supported operations from release metadata/source.

Exercise the exact operation set

Use a disposable file and directory; adapt the base URL to the route exposed by your release:

curl --fail --user 'user@example.com:password' \
  -X OPTIONS 'https://app.example.com/WEB_DAV_BASE/'

curl --fail --user 'user@example.com:password' \
  -T ./disposable.txt \
  'https://app.example.com/WEB_DAV_BASE/disposable.txt'

Then list/read the object, replace it, and delete it. Confirm the resulting file or record through Daptin, not only through a cached client view. Record which of OPTIONS, listing, read, write, create directory, move/copy, delete, locking, and properties the chosen client actually requires.

Test refusal and containment

• Missing and invalid credentials are rejected.
• A user cannot list, read, overwrite, or delete another user’s protected path.
• Parent traversal and encoded traversal attempts cannot escape the configured root.
• Oversized uploads and unsupported methods fail with understandable responses.
• Removing permission takes effect according to the documented cache and session behavior.