fix: calendar-invite status update and login rate-limiter fail-open

Bug Alinto#41 (RepositoryCalendarInvite.update_status): the bulk UPDATE passed a
flat list instead of rows (values_list=[status, now]), so invite
accept/reject crashed. Regression-tested by e2e TC-06.

Bug Alinto#43 (LoginRateLimiter): a stale pooled Redis connection surfaces as raw
ValueError ('I/O operation on closed file'), bypassing redis-py's
ConnectionError retry and 500ing POST /auth/login mid-run. Every limiter
method now fails open (safe default + warning) — rate limiting is an
optimization, not a precondition, for authentication. New unit tests
pin the contract (tests/test_utils/test_api/test_login_rate_limiter.py).

Author: Tobias Weiß

app/module/calendar/repository/RepositoryCalendarInvite.py

@@ -132,7 +132,9 @@ def update_status(self, invite_id: str, status: str) -> None:
         updated = self._db.update_in_table(
             table_name=tbl.TABLE_CALENDAR_INVITE.name,
             column_tuple=(tbl.COL_CAL_INVITE_STATUS.name, tbl.COL_CAL_INVITE_UPDATED_AT.name),
-            values_list=[[status, datetime.now(timezone.utc)]],
+            # update_in_table takes ONE value per column (flat list), not a
+            # row-nested list — [[...]] trips its column/value length check.
+            values_list=[status, datetime.now(timezone.utc)],
             condition=condition,
         )
         if not updated:

app/utils/api/login_rate_limiter.py

@@ -41,12 +41,22 @@ def _r(self):
         return self._redis.redis
 
     # ── Public API ─────────────────────────────────────────────────────────
+    #
+    # All Redis-backed methods FAIL OPEN: a cache hiccup (e.g. a stale pooled
+    # connection raising ``ValueError: I/O operation on closed file`` — which
+    # bypasses redis-py's ConnectionError retry) must never turn into a 500
+    # on the login endpoint. Rate limiting is an optimization, not a
+    # precondition, for authentication.
 
     def is_blocked(self, uid: str, max_attempt: int, block_time: int) -> bool:
         """Return ``True`` if *uid* is currently blocked."""
         if max_attempt <= 0:
             return False
-        blocked = self._r.get(self._block_key(uid))
+        try:
+            blocked = self._r.get(self._block_key(uid))
+        except Exception:
+            logger_api.warning("Login rate-limiter is_blocked failed (fail open)", exc_info=True)
+            return False
         return blocked is not None
 
     def record_failure(self, uid: str, time_span: int) -> int:
@@ -56,14 +66,22 @@ def record_failure(self, uid: str, time_span: int) -> int:
         auto-expires.
         """
         key = self._fail_key(uid)
-        count = self._r.incr(key)
-        if count == 1:
-            self._r.expire(key, time_span)
+        try:
+            count = self._r.incr(key)
+            if count == 1:
+                self._r.expire(key, time_span)
+        except Exception:
+            logger_api.warning("Login rate-limiter record_failure failed (fail open)", exc_info=True)
+            return 0
         return count
 
     def block(self, uid: str, block_time: int) -> None:
         """Mark *uid* as blocked for *block_time* seconds."""
-        self._r.setex(self._block_key(uid), block_time, "1")
+        try:
+            self._r.setex(self._block_key(uid), block_time, "1")
+        except Exception:
+            logger_api.warning("Login rate-limiter block failed (fail open)", exc_info=True)
+            return
         logger_api.warning("Login blocked for uid=%s (%d seconds)", uid, block_time)
 
     def reset_failures(self, uid: str) -> None:
@@ -73,7 +91,11 @@ def reset_failures(self, uid: str) -> None:
 
     def get_fail_count(self, uid: str) -> int:
         """Return the current number of consecutive failures."""
-        val = self._r.get(self._fail_key(uid))
+        try:
+            val = self._r.get(self._fail_key(uid))
+        except Exception:
+            logger_api.warning("Login rate-limiter get_fail_count failed (fail open)", exc_info=True)
+            return 0
         return int(val) if val else 0
 
     # ── Per-IP Rate Limiting ──────────────────────────────────────────────
@@ -87,9 +109,13 @@ def is_ip_rate_limited(self, ip: str, max_attempts: int = 20, window_seconds: in
         :return: True if the IP is rate-limited
         """
         key = self._ip_key(ip)
-        count = self._r.incr(key)
-        if count == 1:
-            self._r.expire(key, window_seconds)
+        try:
+            count = self._r.incr(key)
+            if count == 1:
+                self._r.expire(key, window_seconds)
+        except Exception:
+            logger_api.warning("Login rate-limiter is_ip_rate_limited failed (fail open)", exc_info=True)
+            return False
         return count > max_attempts
 
     def reset_ip_rate_limit(self, ip: str) -> None:

tests/test_utils/test_api/test_login_rate_limiter.py

@@ -0,0 +1,72 @@
+# SPDX-FileCopyrightText: 2025 SOGo project contributors
+# SPDX-License-Identifier: LGPL-2.1-only
+"""LoginRateLimiter must FAIL OPEN on Redis errors.
+
+A stale pooled Redis connection can surface as a raw ``ValueError``
+("I/O operation on closed file") which bypasses redis-py's
+``ConnectionError``-based retry. Authentication must never 500 because of a
+cache hiccup: every limiter method degrades to its safe default instead of
+raising (bug: POST /api/user/v1/auth/login returned 500 mid-suite).
+"""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock
+
+import pytest
+
+from app.utils.api.login_rate_limiter import LoginRateLimiter
+
+
+class _BrokenRedis:
+    """Redis stub whose every operation dies like a stale pooled socket."""
+
+    def __getattr__(self, name):
+        def _raise(*args, **kwargs):
+            raise ValueError("I/O operation on closed file")
+
+        return _raise
+
+
+@pytest.fixture()
+def limiter() -> LoginRateLimiter:
+    wrapper = MagicMock()
+    wrapper.redis = _BrokenRedis()
+    return LoginRateLimiter(wrapper)
+
+
+def test_is_ip_rate_limited_fails_open(limiter: LoginRateLimiter) -> None:
+    assert limiter.is_ip_rate_limited("10.0.0.9", max_attempts=20, window_seconds=60) is False
+
+
+def test_is_blocked_fails_open(limiter: LoginRateLimiter) -> None:
+    assert limiter.is_blocked("user@example.org", max_attempt=5, block_time=60) is False
+
+
+def test_record_failure_fails_open(limiter: LoginRateLimiter) -> None:
+    assert limiter.record_failure("user@example.org", time_span=60) == 0
+
+
+def test_block_fails_open(limiter: LoginRateLimiter) -> None:
+    # Must not raise; block state is best-effort.
+    limiter.block("user@example.org", block_time=30)
+
+
+def test_get_fail_count_fails_open(limiter: LoginRateLimiter) -> None:
+    assert limiter.get_fail_count("user@example.org") == 0
+
+
+def test_healthy_redis_still_limits(limiter: LoginRateLimiter) -> None:
+    """Sanity: with a working backend the limiter still enforces the IP cap."""
+    wrapper = MagicMock()
+    store: dict = {}
+
+    def incr(key):
+        store[key] = store.get(key, 0) + 1
+        return store[key]
+
+    wrapper.redis.incr = incr
+    limiter = LoginRateLimiter(wrapper)
+    for _ in range(20):
+        assert limiter.is_ip_rate_limited("10.0.0.10", max_attempts=20, window_seconds=60) is False
+    assert limiter.is_ip_rate_limited("10.0.0.10", max_attempts=20, window_seconds=60) is True