Read-only CardDAV endpoint so members can sync studio contacts to their phones. CardDAV uses HTTP Basic Auth (no OIDC), so the plan is per-device tokens stored as bcrypt hashes in a CardDAVToken table. The machine-to-machine bearer flow does not apply — a phone's CardDAV client cannot fetch an Authentik token.
Read-only CardDAV endpoint so members can sync studio contacts to their phones. CardDAV uses HTTP Basic Auth (no OIDC), so the plan is per-device tokens stored as bcrypt hashes in a
CardDAVTokentable. The machine-to-machine bearer flow does not apply — a phone's CardDAV client cannot fetch an Authentik token.CardDAVTokenmodelGET /api/carddav(discovery),GET /api/carddav/contacts(vCard list)/api/carddavinpublicPathsinproxy.ts— same reason as/api/usernames