Transport / HTTP filesystem protocol

Preview

WebDAV

WebDAV makes the filesystem contract available through standard HTTP resource methods. The portable server is mount-free; native mounting is a separate davfs/macOS host-client test.

Platform requirements

Rootless HTTP tests run on macOS and Linux. Linux native mounting needsmount.davfs, FUSE, /dev/fuse, and mount privileges; macOS uses /sbin/mount_webdav and host authorization policy.

Mount vs mount-free

The portable path is an HTTP server over an FsDriver and does not mount anything. The ignored native harness is only selected when its platform prerequisites are present and explicitly enabled.

Preview — scoped evidence

Pinned pure protocol differential, direct N-API streaming, active-lock, method, peer-fault, 256-request network and same-session concurrency, durable-driver syncfs barriers, local macOS mounting, and scoped hosted macOS/Linux native jobs pass; full member parity, restart/durability, provider, and hosted lifecycle gates remain open. The current tracker records 17 focused Rust WebDAV tests, a passing isolated locked N-API check, release addon/declaration generation, and a direct buffered session/options/driver/auth slice. The pinned pure protocol differential now passes at the recorded oracle revision. The latest lifecycle slice passed formatting and the locked WebDAV test target, including the immediate listen()/close()lost-wakeup regression and 16 concurrent listen() calls sharing one loopback port. The current packet also qualifies N-API wrapper lifecycle serialization and close-timeout retry-after-failure semantics; host-enabled listener/peer-reset checks pass locally. This remains local lifecycle evidence; restart/hosted session lifecycle stays open. N-API network/hosted concurrency, crash/power-loss restart, and provider durability remain open. The latest host-enabled N-API network packet also passes oneMKCOL, 256 concurrent 64 KiB-plus PUT/GETpairs with counters matching the requested cardinality, chunked stream I/O, Basic authentication, and a live unsupportedPATCH that returns 405 and callsonError once. Child-process SIGKILL probes for SQLite and rooted NodeFs recovered exact file bytes with zero replacement-session locks; these are local N-API/provider checks, not hosted or power-loss proof. The direct streaming facade passes a three-chunk PUT, multi-chunk GET, early response-iterator return, and deliberate request-body failure mapping for async iterables and Web ReadableStreams. ActiveWebdavLockView state exposes direct LOCK/UNLOCK records; an unsubmitted token receives 423, expiry returns the session view to zero, and the direct method matrix covers OPTIONS, MKCOL, PUT, HEAD, GET, PROPFIND, PROPPATCH, COPY, MOVE, LOCK, UNLOCK, DELETE, and explicit PATCH refusal. A peer reset produces exactly one typed transport callback with the accepted loopback peer. A malformed HTTP request produces one typed callback and clean socket/server teardown. Same-driver recreation preserves file bytes while resetting session locks, and 256 parallel direct-session PUTs followed by GETs all return matching bodies. The 64-pair implementation packet had no terminal hosted WebDAV result because its exact-SHA workflow was cancelled by subsequent mainline publication. The 128-pair packet had only pending/queued hosted workflow snapshots, and the newer 256-pair packet's exact-SHA workflow snapshot was also pending/queued, so no hosted WebDAV concurrency PASS is claimable. A failed streamedPUT returns 500 while preserving exactly the bytes already written (partial), matching the pinned oracle's in-place write contract rather than atomic publication. A rooted NodeFs replacement-provider test also reopens exact bytes with zero replacement-session locks. The N-API listener remains blocked in this sandbox by its loopback bind prerequisite. The current postlude also normalizes method counters to the oracle's Map<string, number> shape and exposes a request-levelonError(error, head) callback. The explicit macOS native harness passed 1/1 on Darwin 27 arm64 using/sbin/mount_webdav and /sbin/umount. At exact scope-packet revision e13c52be, hosted native-WebDAV jobs for macOS and Ubuntu completed successfully in run35640746296; those jobs use mount_webdav on macOS and davfs2/FUSE on Ubuntu. The surrounding workflow still had unrelated lanes in progress, so this is scoped native execution evidence, not full hosted session/member or provider acceptance. No local protocol or native pass is promoted to a production mount claim. A pinned TypeScript/Rust HTTP differential now passes 40 paired S3 and WebDAV cases, including 16 authenticated WebDAV cases. Rust-only injected session-clock tests prove exact lock expiry; the N-API binding intentionally keeps the safer serializable options and expiry-aware lock snapshots rather than exposing a synchronous JavaScript clock, assertion hook, or live lock-table mutator. The durable-barrier packet now awaits syncfs after successful PUT, MKCOL, PROPPATCH, COPY, MOVE, DELETE, partial recursive mutation, and LOCK-created resource publication; its focused fault/retry test and locked host-enabled Rust target passed 20/20. A rebuilt local N-API/provider requalification also passed typecheck, lifecycle, 64-pair direct/network/auth/streaming checks, NodeFs/SQLite reopen, provider-backed 128-pair direct and 64-pair loopback network checks, and process-crash/in-flight streamed-PUT recovery. This is local evidence only. Hosted status run35672738319 had no WebDAV PASS, and remote-provider, power-loss, durable-lock, and hosted concurrency gates remain open. The final-ledger-tip status check for run35673381803 likewise had CI and release-policy jobs pending, fault/provider jobs queued or absent, and no hosted WebDAV PASS. The newer exact-tip packet at SHAe5ae05d passed the hosted N-API package jobs on Ubuntu x64, Ubuntu arm64, macOS arm64, and macOS Intel, with the Rust jobs passing on Ubuntu, macOS, and Windows. Its scoped native-WebDAV jobs also passed on macOS and Ubuntu in run 35674823787; the overall workflow remained nonterminal because of an unrelated native-FUSE lane. This upgrades the page's hosted package/native evidence without claiming a full workflow pass, live remote-provider durability, power-loss ordering, durable locks, or mounted-host teardown/concurrency. The newer WebDAV contract explicitly scopes same-resource ordering: without a submitted lock token, concurrent writes are rejected with 423; independent-resource concurrency remains supported, but no linearizable same-resource ordering or atomic same-target PUT publication is claimed. Hosted run35678488755 at exact SHA ed29016 then passed the corrected close-while-mounted, bounded cleanup, relisten/remount, and post-restart round-trip harness on both macOS and Ubuntu native WebDAV jobs. The aggregate remained nonterminal on unrelated jobs, so live-provider durability, power-loss ordering, durable locks, and wider ordering remain open. The follow-up local hardening now requires the oracle/RFC space after Basic, bounds Depth: 1enumeration at 4,096 entries with overflow mapped to413 and connection close, and rejects child-stat or short-source failures during recursive COPY; focused tests and warning-denied Clippy passed, but these are local contract checks. The exact-tip hosted queue run 35681063238 was canceled when successor tip 2bcd9aa4 arrived, and its replacement 35681127696 was later canceled before jobs materialized. No newer hosted WebDAV result was claimable at that checkpoint, so35678488755 remains the latest terminal native result and the current maturity remains Preview. The subsequent exact-tip audit run 35687955166 was cancelled with no jobs, while its protected R2 companion35687955189 stopped at the usage admission guard (count=309 limit=20) and skipped live integration. No hosted WebDAV or live-provider PASS is promoted from that audit. The latest terminal CI packet 35698854392 at source116e9ed4 passed the native WebDAV jobs on macOS and Ubuntu, but the surrounding workflow failed in provider/W26, Windows, and native-FUSE lanes. This is scoped native execution evidence, not a full hosted lifecycle or release-acceptance result. The current N-API package refresh at source c57e2ea3 also passes the WebDAV-only lifecycle, 64-pair direct-session/network concurrency, NodeFs/SQLite provider and network matrices, orderly reopen, process-crash and in-flight PUT recovery, structural-driver durability, Rust WebDAV 41/41, typecheck, strict Clippy, formatting, and diff checks. Manual current-package run35714570430 at exact source92a6539e6a91d67a811b77cf688fc4ad2177f858 is live: its Node Ubuntu x64/arm64 and macOS arm64/Intel jobs completed successfully, and the native WebDAV jobs on Ubuntu and macOS also passed. The aggregate remained nonterminal on unrelated jobs, and no WebDAV, N-API, CI-workflow, or native-build files changed through current tip f9e338e6, so this closes the current hosted package/native slices only. A completion audit at sourcec990cc52 records the same supported 4-OS matrix alongside the local protocol/session/provider-crash evidence. Live provider behavior, physical power-loss/crash durability, and external AWS/R2 admission remain open; durable-lock persistence and stronger same-resource ordering are explicit supported-scope exclusions. A current published-tip Rust requalification at sourceebac1450 passed WebDAV 41/41, warning-denied Clippy, formatting, git diff --check, and the no-worktree-target check. A relevance audit found no changes between the hosted SHA and this tip in the WebDAV transport, N-API binding, CI workflow, or native build wrapper, so the hosted package/native matrix covers the current implementation for its supported packet.

What the transport exposes

The server implements class-1 OPTIONS/GET/HEAD/PUT/MKCOL/DELETE/COPY/ MOVE/PROPFIND and bounded class-2 locking/property behavior. Reads are streamed with positional operations; uploads are bounded and incremental.

Keep protocol and native checks separate

Evidence-oriented check
cargo test -p mount-rs-webdav --locked

# Prepared host only, Linux or macOS:
MOUNT_RS_WEBDAV_NATIVE_TEST=1   cargo test -p mount-rs-webdav --test native_mount   -- --ignored --nocapture

Safe use and lifecycle

Bind the service to loopback during tests, bound XML/request bodies, and use an owned empty mountpoint for native checks. Add TLS and authentication before exposing WebDAV beyond a trusted local boundary.

Current limitations

Multi-range requests are intentionally unsupported, unknown properties are protected, and the native harness is not part of ordinary tests. A passing HTTP protocol test is not universal client or mount interoperability evidence.

← Back to transports