CardDAV Address Book

• Part of: LH Vcard

Since 1.10.0 each site’s members are also available as a read-only CardDAV address book, so staff can sync the whole club into their phone or desktop contacts instead of downloading cards. It replaced the separate LH CardDAV Server plugin, which was retired. A synced card is built by the same code as a downloaded one, so both always carry the same data.

Setting it up

You need the capability that shows vCard links (publish_posts by default) and an application password (Users → Profile → Application Passwords). Your normal account password is not accepted.

• iPhone: Settings → Apps → Contacts → Contacts Accounts → Add Account → Other → Add CardDAV Account. Server is the site’s domain (e.g. princesparktouch.com), then your username and the application password.
• Android (DAVx5): Login with URL and user name, using https:// plus the site’s domain.
• Thunderbird: New CardDAV address book, using https:// plus the site’s domain.

Apps find the address book on their own through /.well-known/carddav. If one does not, give it the full address: the site’s domain followed by /carddav/.

What is in it

• Every member of the site, except members blocked on it (LH Buddypress Block Members).
• Teams are the BuddyPress groups the person syncing can see: public and private groups always, hidden groups only for their own members and BuddyPress moderators. Downloads follow the same rule for whoever generated the link.
• It is read-only. Contacts apps cannot edit or delete cards; the site is the only place to change member details.

How syncing works

The first sync sends every card. After that, clients use sync-collection (RFC 6578) and receive only the cards that changed, plus deletions for members who left the site or were blocked. A card counts as changed when its REV (last-changed time on that site) moves, which happens on changes to tracked user meta, email, display name, BuddyPress profile fields, the avatar, group membership, or a group’s name or status. Removals are remembered for 90 days; a client whose sync token is older than that is asked to start again with a full sync.

ETags, the collection CTag and sync tokens include a hash of which hidden groups the syncing user can see, and the plugin version, so a change in either refreshes that user’s cards.

Architecture

• LH_Vcard_Carddav_Handler – the protocol: a rewrite endpoint dispatched on parse_request, speaking WebDAV XML (PROPFIND, REPORT, GET, HEAD, OPTIONS). Not a REST route: the REST server only speaks JSON and runs every determine_current_user filter.
• LH_Vcard_Carddav_Auth – HTTP Basic Auth checked with wp_authenticate_application_password() directly, so other authentication filters (IndieAuth, SSO) take no part.
• LH_Vcard_Carddav_Address_Book – membership, revisions, ETags, CTag, sync tokens and changes.
• LH_Vcard_Change_Tracker – records each card’s REV per site and keeps removal tombstones (option lh_vcard-carddav_tombstones). Writes name their site explicitly instead of switching blogs.

Download tokens now carry the viewer as well: {expiry}.{viewer_id}.{hmac}. Tokens from before 1.10.0 ({expiry}.{hmac}) are still accepted until they expire, as a viewer who sees no hidden groups.