From 8051e25c65017b9cb492079fe42c90be71de8f4b Mon Sep 17 00:00:00 2001
From: red person <redpersoncoding@gmail.com>
Date: Wed, 3 Jun 2026 02:57:15 +0300
Subject: [PATCH] Reject CalDAV writeback events without uid (#1582)

---
 src/caldav_writeback.py        | 5 ++++-
 tests/test_caldav_writeback.py | 7 +++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/caldav_writeback.py b/src/caldav_writeback.py
index 2f0479e..f20c2b4 100644
--- a/src/caldav_writeback.py
+++ b/src/caldav_writeback.py
@@ -93,11 +93,14 @@ def push_event(calendars, local_cal_id: str, ev: dict, *, delete: bool = False)
     Returns ``{"ok": bool, ...}``. ``calendars`` is the discovered caldav
     calendar list (injected so this is unit-testable with fakes).
     """
+    uid = (ev or {}).get("uid") if isinstance(ev, dict) else None
+    if not uid:
+        return {"ok": False, "error": "event uid is required"}
+
     remote = find_remote_calendar(calendars, local_cal_id)
     if remote is None:
         return {"ok": False, "error": "remote calendar not found"}
 
-    uid = ev["uid"]
     try:
         existing = remote.event_by_uid(uid)
     except Exception:
diff --git a/tests/test_caldav_writeback.py b/tests/test_caldav_writeback.py
index ea5d758..c501ad1 100644
--- a/tests/test_caldav_writeback.py
+++ b/tests/test_caldav_writeback.py
@@ -116,3 +116,10 @@ def test_push_unknown_calendar_reports_not_found():
     cal = FakeCalendar("https://different/")
     res = push_event([cal], CAL_ID, _ev())
     assert res["ok"] is False and "not found" in res["error"]
+
+
+def test_push_missing_uid_reports_input_error_before_remote_lookup():
+    cal = FakeCalendar(REMOTE_URL, existing=FakeEvent())
+    res = push_event([cal], CAL_ID, _ev(uid=""))
+    assert res["ok"] is False and "uid" in res["error"]
+    assert cal._existing.saved is False