fix(dav): suppress iTip REQUEST for PARTSTAT-only occurrence overrides

When an attendee accepts or declines a single occurrence of a recurring
event, the resulting RECURRENCE-ID override VEVENT carries only that
attendee's PARTSTAT change. TipBroker previously flagged every emitted
REQUEST as significant, causing IMipPlugin to send re-invite mails to all
other attendees even though nothing material changed for them.

Compute significantChange per attendee, comparing the master and existing
overrides on the significantChangeProperties set, and -- for newly added
overrides -- comparing against the inherited master state (asymmetric: the
override's own DTSTART/DTEND are expected to differ from the master because
they describe a different occurrence; what counts is a shift relative to
the override's own RECURRENCE-ID, a duration change, or a date-independent
property override). New attendees, partial-instance removals, and
SCHEDULE-FORCE-SEND=REQUEST continue to be treated as significant.

PARTSTAT changes alone never trigger significance per RFC 5546 -- that
flow is REPLY-only. The existing gate at IMipPlugin.php:105 then suppresses
the email.

Resolves: #60452

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Nico Donath <ndo84bw@gmx.de>

Author: ndo84bw

apps/dav/lib/CalDAV/TipBroker.php

@@ -215,14 +215,199 @@ protected function parseEventForOrganizer(VCalendar $calendar, array $eventInfo,
 				}
 			}
 
+			$significant = $this->isRequestSignificantForAttendee($attendee, $eventInfo, $oldEventInfo);
 			$messages[] = $this->generateMessage(
-				$instances, $organizerHref, $organizerName, $eventInfo['attendees'][$attendee], $objectId, $objectType, $objectSequence, 'REQUEST', $template
+				$instances, $organizerHref, $organizerName, $eventInfo['attendees'][$attendee], $objectId, $objectType, $objectSequence, 'REQUEST', $template, $significant
 			);
 		}
 
 		return $messages;
 	}
 
+	/**
+	 * Decide whether a REQUEST is materially relevant for a specific attendee.
+	 *
+	 * A REQUEST broadcast is meaningful only when something the attendee would
+	 * actually care about changed: scheduling-significant properties on the
+	 * master or on an instance they participate in, the introduction of a new
+	 * override that overrides inherited master state, the attendee being added
+	 * or partially removed, or a forced SCHEDULE-FORCE-SEND=REQUEST.
+	 *
+	 * PARTSTAT changes alone are NOT significant for organizer→attendee
+	 * REQUEST broadcasts; that flow is REPLY-only per RFC 5546. Suppressing
+	 * here fixes the per-occurrence accept/decline re-invite spam.
+	 */
+	protected function isRequestSignificantForAttendee(
+		string $attendeeHref,
+		array $eventInfo,
+		array $oldEventInfo,
+	): bool {
+		$newAttendee = $eventInfo['attendees'][$attendeeHref] ?? null;
+		$oldAttendee = $oldEventInfo['attendees'][$attendeeHref] ?? null;
+
+		if (($newAttendee['forceSend'] ?? null) === 'REQUEST') {
+			return true;
+		}
+		if ($oldAttendee === null) {
+			return true;
+		}
+
+		$newMaster = $eventInfo['instances']['master'] ?? null;
+		$oldMaster = $oldEventInfo['instances']['master'] ?? null;
+		if (($newMaster === null) !== ($oldMaster === null)) {
+			return true;
+		}
+		if ($newMaster !== null && $oldMaster !== null
+			&& $this->instancesDifferInSignificantProperties($newMaster, $oldMaster)) {
+			return true;
+		}
+
+		foreach (($newAttendee['instances'] ?? []) as $instanceId => $_) {
+			if ($instanceId === 'master') {
+				continue;
+			}
+			$newInstance = $eventInfo['instances'][$instanceId] ?? null;
+			if ($newInstance === null) {
+				continue;
+			}
+			$oldInstance = $oldEventInfo['instances'][$instanceId] ?? null;
+			if ($oldInstance !== null) {
+				if ($this->instancesDifferInSignificantProperties($newInstance, $oldInstance)) {
+					return true;
+				}
+			} elseif ($oldMaster !== null
+				&& $this->overrideDiffersFromInheritedMaster($newInstance, $oldMaster)) {
+				return true;
+			}
+		}
+
+		foreach (($oldAttendee['instances'] ?? []) as $instanceId => $_) {
+			if (!isset($newAttendee['instances'][$instanceId])) {
+				return true;
+			}
+		}
+
+		// Synthesized-EXDATE diff: parseEventForOrganizer injects a per-attendee
+		// EXDATE on the outbound master for every override the attendee is not
+		// part of. If this synthesized set changed between old and new state
+		// (a brand-new override now excludes them, or an override they weren't
+		// on was removed), the REQUEST content materially changes and they
+		// must receive it.
+		$newSynthExdates = $this->synthesizedExdatesForAttendee($eventInfo, $newAttendee);
+		$oldSynthExdates = $this->synthesizedExdatesForAttendee($oldEventInfo, $oldAttendee);
+		if ($newSynthExdates !== $oldSynthExdates) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * @param array $eventInfo An eventInfo dict as produced by parseEventInfo()
+	 * @param array $attendee The merged attendee dict for the recipient
+	 * @return list<string> Sorted list of RECURRENCE-ID values for overrides
+	 *                      this attendee is not on (the EXDATE values that would
+	 *                      be injected into their REQUEST master).
+	 */
+	protected function synthesizedExdatesForAttendee(array $eventInfo, array $attendee): array {
+		$exdates = [];
+		foreach (($eventInfo['instances'] ?? []) as $instanceId => $instance) {
+			if ($instanceId === 'master'
+				|| isset($attendee['instances'][$instanceId])
+				|| !isset($instance->{'RECURRENCE-ID'})) {
+				continue;
+			}
+			$exdates[] = (string)$instance->{'RECURRENCE-ID'}->getValue();
+		}
+		sort($exdates);
+		return $exdates;
+	}
+
+	/**
+	 * Decide whether a newly-introduced override actually changes anything the
+	 * attendee would have inherited from the master.
+	 *
+	 * Unlike a generic significant-property diff, this is asymmetric: the
+	 * override's DTSTART/DTEND are *expected* to differ from the master's
+	 * (they describe a different occurrence). What matters is whether the
+	 * override shifts the time relative to its own RECURRENCE-ID, changes
+	 * duration, or rewrites any date-independent property.
+	 */
+	protected function overrideDiffersFromInheritedMaster(Component $override, Component $master): bool {
+		foreach (['SUMMARY', 'LOCATION', 'DESCRIPTION', 'STATUS'] as $prop) {
+			$oVal = isset($override->$prop) ? (string)$override->$prop->getValue() : null;
+			$mVal = isset($master->$prop) ? (string)$master->$prop->getValue() : null;
+			if ($oVal !== $mVal) {
+				return true;
+			}
+		}
+
+		if (isset($override->DTSTART, $override->{'RECURRENCE-ID'})) {
+			try {
+				$dtstart = $override->DTSTART->getDateTime();
+				$recurId = $override->{'RECURRENCE-ID'}->getDateTime();
+				if ($dtstart->getTimestamp() !== $recurId->getTimestamp()) {
+					return true;
+				}
+			} catch (\Exception $e) {
+				return true;
+			}
+		}
+
+		try {
+			$overrideDuration = $this->computeDurationSeconds($override);
+			$masterDuration = $this->computeDurationSeconds($master);
+			if ($overrideDuration !== null && $masterDuration !== null
+				&& $overrideDuration !== $masterDuration) {
+				return true;
+			}
+		} catch (\Exception $e) {
+			return true;
+		}
+
+		// An override should not carry its own recurrence rules; if it does,
+		// the organizer is doing something unusual and we should not suppress.
+		foreach (['RRULE', 'RDATE', 'EXDATE'] as $prop) {
+			if (isset($override->$prop)) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	protected function computeDurationSeconds(Component $vevent): ?int {
+		if (isset($vevent->DTSTART, $vevent->DTEND)) {
+			return $vevent->DTEND->getDateTime()->getTimestamp()
+				- $vevent->DTSTART->getDateTime()->getTimestamp();
+		}
+		if (isset($vevent->DURATION)) {
+			$interval = $vevent->DURATION->getDateInterval();
+			$ref = new \DateTimeImmutable('@0');
+			return $ref->add($interval)->getTimestamp();
+		}
+		return null;
+	}
+
+	protected function instancesDifferInSignificantProperties(Component $a, Component $b): bool {
+		foreach ($this->significantChangeProperties as $prop) {
+			$aValues = [];
+			foreach ($a->select($prop) as $val) {
+				$aValues[] = (string)$val->getValue();
+			}
+			$bValues = [];
+			foreach ($b->select($prop) as $val) {
+				$bValues[] = (string)$val->getValue();
+			}
+			sort($aValues);
+			sort($bValues);
+			if ($aValues !== $bValues) {
+				return true;
+			}
+		}
+		return false;
+	}
+
 	/**
 	 * Generates an iTip message for a specific attendee
 	 *
@@ -241,6 +426,9 @@ protected function parseEventForOrganizer(VCalendar $calendar, array $eventInfo,
 	 * @param int $objectSequence The sequence number of the event
 	 * @param string $method The iTip method ('REQUEST', 'CANCEL', 'REPLY', etc.)
 	 * @param VCalendar $template The template calendar object (without event components)
+	 * @param bool|null $significantChange Whether the change is significant for this attendee.
+	 *                                     Defaults to true to preserve historical behavior for
+	 *                                     CANCEL paths. REQUEST callers compute it explicitly.
 	 * @return Message The generated iTip message ready to be sent
 	 */
 	protected function generateMessage(
@@ -253,6 +441,7 @@ protected function generateMessage(
 		int $objectSequence,
 		string $method,
 		VCalendar $template,
+		?bool $significantChange = null,
 	): Message {
 
 		$recipientAddress = $attendee['href'] ?? '';
@@ -277,7 +466,7 @@ protected function generateMessage(
 		$message->senderName = $organizerName;
 		$message->recipient = $recipientAddress;
 		$message->recipientName = $recipientName;
-		$message->significantChange = true;
+		$message->significantChange = $significantChange ?? true;
 		$message->message = $vObject;
 
 		return $message;