CardDAV app-password endpoint inconsistent with webmail/Thunderbird OAuth contacts

Summary

CardDAV contacts exposed through app-password/basic authentication are inconsistent with the contacts shown in Thundermail webmail and Thunderbird OAuth sync.

KDE Kontact/Akonadi sees the same empty CardDAV collection that direct CardDAV requests see, while webmail and Thunderbird still show contacts.

Account / Endpoint

• Account: v7k@thundermail.com
• CardDAV collection discovered by clients:
  https://mail.thundermail.com/dav/card/v7k%40thundermail.com/default/
• Client using app-password/basic auth:
  KDE Kontact / Akonadi DAV resource
• Client using OAuth/browser auth:
  Thunderbird

Symptoms

1. Contacts created in Kontact were uploaded through CardDAV successfully.
2. Contacts shown in Thundermail webmail / Thunderbird OAuth did not appear in Kontact.
3. After deleting contacts through app-password CardDAV, the app-password CardDAV endpoint reports the address book is empty.
4. Thundermail webmail still shows those contacts.
5. Thunderbird still shows test2@example.com after synchronization.

This looks like app-password CardDAV and OAuth/webmail contacts are backed by inconsistent views or are not syncing with each other.

Reproduction / Observed Results

Using app-password/basic auth against:

https://mail.thundermail.com/dav/card/v7k%40thundermail.com/default/

PROPFIND discovery succeeds and reports the address book:

HTTP/1.1 207 Multi-Status
displayname: Thundermail Address Book (v7k@thundermail.com)
resourcetype: collection + addressbook
getctag: "45"
sync-token: urn:stalwart:davsync:2d

But REPORT addressbook-query returns no contacts:

HTTP/1.1 207 Multi-Status
responsedescription: No resources found

Direct GET requests for contacts that webmail still lists return 404 Not Found, for example:

GET /dav/card/v7k%40thundermail.com/default/akonadi-clean-server-test-001.vcf
HTTP/1.1 404 Not Found

GET /dav/card/v7k%40thundermail.com/default/kontact-curl-test-1784938508.vcf
HTTP/1.1 404 Not Found

GET /dav/card/v7k%40thundermail.com/default/1784923840.R981.vcf
HTTP/1.1 404 Not Found

At the same time, webmail shows 12 contacts, including contacts previously created through app-password CardDAV:

Akonadi Clean Server Test <akonadi-clean-server-test@example.invalid>
Kontact Curl Test <kontact-curl-test-1784938508@example.invalid>
Kontact Curl Test <kontact-curl-test-1784938595@example.invalid>
Kontact Curl Test <kontact-curl-test-1784938647@example.invalid>
Kontact Curl Test <kontact-curl-test-1784938995@example.invalid>
Kontact Curl Test <kontact-curl-test-1784968267@example.invalid>
Kontact Curl Test <kontact-curl-test-1784968467@example.invalid>
test
Test Contact <testcontact@example.com>
test1 <test1@example.com>
test3 <test3@example.com>
test4 <test4@test.com>

Additional Details

Earlier, before deleting test contacts through CardDAV, app-password CardDAV operations worked individually:

• PROPFIND: 207 Multi-Status
• PUT: 201 Created
• GET: 200 OK
• REPORT addressbook-query: 207 Multi-Status
• REPORT addressbook-multiget: 207 Multi-Status
• DELETE: 204 No Content

However, after successful CardDAV deletes, webmail still displayed the deleted contacts. This suggests the issue is not simply client-side parsing in KDE Kontact.

KDE/Akonadi debug logs showed that Akonadi discovered the collection correctly and listed server hrefs when they were visible via app-password CardDAV. Later, once app-password CardDAV reported no resources, Akonadi correctly showed zero contacts.

Expected Result

The contacts visible in Thundermail webmail and Thunderbird OAuth should be the same contacts exposed through the app-password CardDAV endpoint.

Contacts created/deleted via app-password CardDAV should appear/disappear in webmail and Thunderbird OAuth after synchronization.

Actual Result

The app-password CardDAV endpoint and webmail/Thunderbird OAuth views appear inconsistent:

• app-password CardDAV currently reports no contacts
• webmail shows 12 contacts
• Thunderbird OAuth still shows at least one contact after sync
• direct CardDAV GET for webmail-listed contacts returns 404

Impact

Generic CardDAV clients such as KDE Kontact cannot synchronize Thundermail contacts reliably unless they use the same contact backend/view as webmail and Thunderbird OAuth.

No source files or tests are named. Start by tracing the CardDAV endpoint and comparing its app-password/basic-auth contact view with the webmail and Thunderbird OAuth contact path; done means contacts created or deleted through either path appear consistently in all three views.