🎉(all) bootstrap the Calendars project

This repository was forked from Drive in late December 2025 and
boostraped as a minimal demo of backend+caldav server+frontend
integration. There is much left to do and to fix!

src/backend/core/tests/authentication/test_backends.py

@@ -0,0 +1,579 @@
+"""Unit tests for the Authentication Backends."""
+
+import random
+import re
+from unittest import mock
+
+from django.core.exceptions import SuspiciousOperation
+from django.test.utils import override_settings
+
+import pytest
+import responses
+from cryptography.fernet import Fernet
+from lasuite.oidc_login.backends import get_oidc_refresh_token
+
+from core import models
+from core.authentication.backends import OIDCAuthenticationBackend
+from core.authentication.exceptions import UserCannotAccessApp
+from core.factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+def test_authentication_getter_existing_user_no_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user matches the user's info sub, the user should be returned.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": db_user.sub}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(1):
+        user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == db_user
+
+
+def test_authentication_getter_existing_user_via_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user doesn't match the sub but matches the email,
+    the user should be returned.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": db_user.email}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(4):  # user by sub, user by mail, update sub
+        user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == db_user
+
+
+def test_authentication_getter_email_none(monkeypatch):
+    """
+    If no user is found with the sub and no email is provided, a new user should be created.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory(email=None)
+
+    def get_userinfo_mocked(*args):
+        user_info = {"sub": "123"}
+        if random.choice([True, False]):
+            user_info["email"] = None
+        return user_info
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    # Since the sub and email didn't match, it should create a new user
+    assert models.User.objects.count() == 2
+    assert user != db_user
+    assert user.sub == "123"
+
+
+def test_authentication_getter_existing_user_no_fallback_to_email_allow_duplicate(
+    settings, monkeypatch
+):
+    """
+    When the "OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION" setting is set to False,
+    the system should not match users by email, even if the email matches.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory()
+
+    # Set the setting to False
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = False
+    settings.OIDC_ALLOW_DUPLICATE_EMAILS = True
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": db_user.email}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    # Since the sub doesn't match, it should create a new user
+    assert models.User.objects.count() == 2
+    assert user != db_user
+    assert user.sub == "123"
+
+
+def test_authentication_getter_existing_user_no_fallback_to_email_no_duplicate(
+    settings, monkeypatch
+):
+    """
+    When the "OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION" setting is set to False,
+    the system should not match users by email, even if the email matches.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory()
+
+    # Set the setting to False
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = False
+    settings.OIDC_ALLOW_DUPLICATE_EMAILS = False
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": db_user.email}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with pytest.raises(
+        SuspiciousOperation,
+        match=(
+            "We couldn't find a user with this sub but the email is already associated "
+            "with a registered user."
+        ),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    # Since the sub doesn't match, it should not create a new user
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_existing_user_with_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    When the user's info contains an email and targets an existing user,
+    """
+    klass = OIDCAuthenticationBackend()
+    user = UserFactory(full_name="John Doe", short_name="John")
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # Only 1 query because email and names have not changed
+    with django_assert_num_queries(1):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+
+
+@pytest.mark.parametrize(
+    "first_name, last_name, email",
+    [
+        ("Jack", "Doe", "john.doe@example.com"),
+        ("John", "Duy", "john.doe@example.com"),
+        ("John", "Doe", "jack.duy@example.com"),
+        ("Jack", "Duy", "jack.duy@example.com"),
+    ],
+)
+def test_authentication_getter_existing_user_change_fields_sub(
+    first_name, last_name, email, django_assert_num_queries, monkeypatch
+):
+    """
+    It should update the email or name fields on the user when they change
+    and the user was identified by its "sub".
+    """
+    klass = OIDCAuthenticationBackend()
+    user = UserFactory(
+        full_name="John Doe", short_name="John", email="john.doe@example.com"
+    )
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": email,
+            "first_name": first_name,
+            "last_name": last_name,
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # One and only one additional update query when a field has changed
+    with django_assert_num_queries(3):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+    user.refresh_from_db()
+    assert user.email == email
+    assert user.full_name == f"{first_name:s} {last_name:s}"
+    assert user.short_name == first_name
+
+
+@pytest.mark.parametrize(
+    "first_name, last_name, email",
+    [
+        ("Jack", "Doe", "john.doe@example.com"),
+        ("John", "Duy", "john.doe@example.com"),
+    ],
+)
+def test_authentication_getter_existing_user_change_fields_email(
+    first_name, last_name, email, django_assert_num_queries, monkeypatch
+):
+    """
+    It should update the name fields on the user when they change
+    and the user was identified by its "email" as fallback.
+    """
+    klass = OIDCAuthenticationBackend()
+    user = UserFactory(
+        full_name="John Doe", short_name="John", email="john.doe@example.com"
+    )
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "123",
+            "email": user.email,
+            "first_name": first_name,
+            "last_name": last_name,
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # One and only one additional update query when a field has changed
+    with django_assert_num_queries(4):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+    user.refresh_from_db()
+    assert user.email == email
+    assert user.full_name == f"{first_name:s} {last_name:s}"
+    assert user.short_name == first_name
+
+
+def test_authentication_getter_new_user_no_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    User's info doesn't contain an email, created user's email should be empty.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email is None
+    assert user.full_name is None
+    assert user.short_name is None
+    assert user.has_usable_password() is False
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_new_user_with_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    User's email and name should be set on the identity.
+    The "email" field on the User model should not be set as it is reserved for staff users.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    email = "calendars@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": email, "first_name": "John", "last_name": "Doe"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email == email
+    assert user.full_name == "John Doe"
+    assert user.short_name == "John"
+    assert user.has_usable_password() is False
+    assert models.User.objects.count() == 1
+
+
+@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
+@responses.activate
+def test_authentication_get_userinfo_json_response():
+    """Test get_userinfo method with a JSON response."""
+
+    responses.add(
+        responses.GET,
+        re.compile(r".*/userinfo"),
+        json={
+            "first_name": "John",
+            "last_name": "Doe",
+            "email": "john.doe@example.com",
+        },
+        status=200,
+    )
+
+    oidc_backend = OIDCAuthenticationBackend()
+    result = oidc_backend.get_userinfo("fake_access_token", None, None)
+
+    assert result["first_name"] == "John"
+    assert result["last_name"] == "Doe"
+    assert result["email"] == "john.doe@example.com"
+
+
+@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
+@responses.activate
+def test_authentication_get_userinfo_token_response(monkeypatch, settings):
+    """Test get_userinfo method with a token response."""
+    settings.OIDC_RP_SIGN_ALGO = "HS256"  # disable JWKS URL call
+    responses.add(
+        responses.GET,
+        re.compile(r".*/userinfo"),
+        body="fake.jwt.token",
+        status=200,
+        content_type="application/jwt",
+    )
+
+    def mock_verify_token(self, token):  # pylint: disable=unused-argument
+        return {
+            "first_name": "Jane",
+            "last_name": "Doe",
+            "email": "jane.doe@example.com",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "verify_token", mock_verify_token)
+
+    oidc_backend = OIDCAuthenticationBackend()
+    result = oidc_backend.get_userinfo("fake_access_token", None, None)
+
+    assert result["first_name"] == "Jane"
+    assert result["last_name"] == "Doe"
+    assert result["email"] == "jane.doe@example.com"
+
+
+@override_settings(OIDC_OP_USER_ENDPOINT="http://oidc.endpoint.test/userinfo")
+@responses.activate
+def test_authentication_get_userinfo_invalid_response(settings):
+    """
+    Test get_userinfo method with an invalid JWT response that
+    causes verify_token to raise an error.
+    """
+    settings.OIDC_RP_SIGN_ALGO = "HS256"  # disable JWKS URL call
+    responses.add(
+        responses.GET,
+        re.compile(r".*/userinfo"),
+        body="fake.jwt.token",
+        status=200,
+        content_type="application/jwt",
+    )
+
+    oidc_backend = OIDCAuthenticationBackend()
+
+    with pytest.raises(
+        SuspiciousOperation,
+        match="User info response was not valid JWT",
+    ):
+        oidc_backend.get_userinfo("fake_access_token", None, None)
+
+
+def test_authentication_getter_existing_disabled_user_via_sub(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user matches the sub but is disabled,
+    an error should be raised and a user should not be created.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory(is_active=False)
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": db_user.sub,
+            "email": db_user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(1),
+        pytest.raises(SuspiciousOperation, match="User account is disabled"),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_existing_disabled_user_via_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user does not match the sub but matches the email and is disabled,
+    an error should be raised and a user should not be created.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = UserFactory(is_active=False)
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "random",
+            "email": db_user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(2),
+        pytest.raises(SuspiciousOperation, match="User account is disabled"),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.count() == 1
+
+
+@responses.activate
+def test_authentication_session_tokens(
+    django_assert_num_queries, monkeypatch, rf, settings
+):
+    """
+    Test that the session contains oidc_refresh_token and oidc_access_token after authentication.
+    """
+    settings.OIDC_OP_TOKEN_ENDPOINT = "http://oidc.endpoint.test/token"
+    settings.OIDC_OP_USER_ENDPOINT = "http://oidc.endpoint.test/userinfo"
+    settings.OIDC_OP_JWKS_ENDPOINT = "http://oidc.endpoint.test/jwks"
+    settings.OIDC_STORE_ACCESS_TOKEN = True
+    settings.OIDC_STORE_REFRESH_TOKEN = True
+    settings.OIDC_STORE_REFRESH_TOKEN_KEY = Fernet.generate_key()
+
+    klass = OIDCAuthenticationBackend()
+    request = rf.get("/some-url", {"state": "test-state", "code": "test-code"})
+    request.session = {}
+
+    def verify_token_mocked(*args, **kwargs):
+        return {"sub": "123", "email": "test@example.com"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "verify_token", verify_token_mocked)
+
+    responses.add(
+        responses.POST,
+        re.compile(settings.OIDC_OP_TOKEN_ENDPOINT),
+        json={
+            "access_token": "test-access-token",
+            "refresh_token": "test-refresh-token",
+        },
+        status=200,
+    )
+
+    responses.add(
+        responses.GET,
+        re.compile(settings.OIDC_OP_USER_ENDPOINT),
+        json={"sub": "123", "email": "test@example.com"},
+        status=200,
+    )
+
+    with django_assert_num_queries(27):
+        user = klass.authenticate(
+            request,
+            code="test-code",
+            nonce="test-nonce",
+            code_verifier="test-code-verifier",
+        )
+
+    assert user is not None
+    assert request.session["oidc_access_token"] == "test-access-token"
+    assert get_oidc_refresh_token(request.session) == "test-refresh-token"
+
+
+@override_settings(OIDC_STORE_CLAIMS=["iss"])
+def test_authentication_store_claims_new_user(monkeypatch):
+    """
+    Test that the claims are stored on the user when a new user is created.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    email = "calendars@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "123",
+            "email": email,
+            "first_name": "John",
+            "last_name": "Doe",
+            "iss": "https://example.com",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email == email
+    assert user.full_name == "John Doe"
+    assert user.short_name == "John"
+    assert user.has_usable_password() is False
+    assert user.claims == {"iss": "https://example.com"}
+    assert models.User.objects.count() == 1
+
+
+@override_settings(OIDC_STORE_CLAIMS=["iss"])
+def test_authentication_store_claims_existing_user(monkeypatch):
+    """
+    Test that the claims are stored on the user when an existing user is authenticated.
+    """
+    klass = OIDCAuthenticationBackend()
+    user = UserFactory(
+        email="calendars@example.com", sub="123", claims={"iss": "https://obsolete.com"}
+    )
+    email = "calendars@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "123",
+            "email": email,
+            "first_name": "John",
+            "last_name": "Doe",
+            "iss": "https://example.com",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    user.refresh_from_db()
+    assert user.sub == "123"
+    assert user.email == email
+    assert user.claims == {"iss": "https://example.com"}
+    assert models.User.objects.count() == 1

src/backend/core/tests/authentication/test_views.py

@@ -0,0 +1,66 @@
+"""Unit tests for the Authentication Views."""
+
+from unittest import mock
+
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.test import RequestFactory
+from django.test.utils import override_settings
+
+import pytest
+from mozilla_django_oidc.auth import (
+    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
+)
+
+from core import factories
+from core.authentication.backends import OIDCAuthenticationBackend
+from core.authentication.views import (
+    OIDCAuthenticationCallbackView,
+)
+
+pytestmark = pytest.mark.django_db
+
+
+@override_settings(
+    LOGIN_REDIRECT_URL_FAILURE="/auth/failure",
+    LOGIN_REDIRECT_URL="/auth/success",
+)
+@mock.patch.object(
+    MozillaOIDCAuthenticationBackend,
+    "get_token",
+    return_value={"id_token": "mocked_id_token", "access_token": "mocked_access_token"},
+)
+@mock.patch.object(
+    MozillaOIDCAuthenticationBackend, "verify_token", return_value={"not": "needed"}
+)
+@mock.patch.object(
+    OIDCAuthenticationBackend,
+    "get_userinfo",
+    return_value={"sub": "mocked_sub", "email": "allowed@example.com"},
+)
+def test_view_login_callback_authorized_by_default(
+    mocked_get_userinfo, mocked_verify_token, mocked_get_token
+):
+    """By default, all users are authorized to login."""
+
+    user = factories.UserFactory(email="allowed@example.com")
+
+    request = RequestFactory().get(
+        "/callback/", data={"state": "mocked_state", "code": "mocked_code"}
+    )
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    mocked_state = "mocked_state"
+    request.session["oidc_states"] = {mocked_state: {"nonce": "mocked_nonce"}}
+    request.session.save()
+
+    callback_view = OIDCAuthenticationCallbackView.as_view()
+
+    response = callback_view(request)
+    mocked_get_token.assert_called_once()
+    mocked_verify_token.assert_called_once()
+    mocked_get_userinfo.assert_called_once()
+    assert response.status_code == 302
+    assert response.url == "/auth/success"

src/backend/core/tests/conftest.py

@@ -0,0 +1,148 @@
+"""Fixtures for tests in the calendars core application"""
+
+import base64
+from unittest import mock
+
+from django.core.cache import cache
+from django.db import connection
+
+import pytest
+import responses
+from cryptography.fernet import Fernet
+
+from core import factories
+from core.tests.utils.urls import reload_urls
+
+USER = "user"
+TEAM = "team"
+VIA = [USER, TEAM]
+
+
+@pytest.fixture(autouse=True)
+def truncate_davical_tables(django_db_setup, django_db_blocker):
+    """Fixture to truncate DAViCal tables at the start of each test.
+
+    DAViCal tables are created by the DAViCal container migrations, not Django.
+    We just truncate them to ensure clean state for each test.
+    """
+    with django_db_blocker.unblock():
+        with connection.cursor() as cursor:
+            # Truncate DAViCal tables if they exist (created by DAViCal container)
+            cursor.execute("""
+                DO $$ 
+                BEGIN
+                    IF EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'principal') THEN
+                        TRUNCATE TABLE principal CASCADE;
+                    END IF;
+                    IF EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'usr') THEN
+                        TRUNCATE TABLE usr CASCADE;
+                    END IF;
+                END $$;
+            """)
+    yield
+
+
+@pytest.fixture(autouse=True)
+def clear_cache():
+    """Fixture to clear the cache after each test."""
+    yield
+    cache.clear()
+    # Clear functools.cache for functions decorated with @functools.cache
+
+
+@pytest.fixture
+def mock_user_teams():
+    """Mock for the "teams" property on the User model."""
+    with mock.patch(
+        "core.models.User.teams", new_callable=mock.PropertyMock
+    ) as mock_teams:
+        yield mock_teams
+
+
+def resource_server_backend_setup(settings):
+    """
+    A fixture to create a user token for testing.
+    """
+    assert (
+        settings.OIDC_RS_BACKEND_CLASS
+        == "lasuite.oidc_resource_server.backend.ResourceServerBackend"
+    )
+
+    settings.OIDC_RESOURCE_SERVER_ENABLED = True
+    settings.OIDC_RS_CLIENT_ID = "some_client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "some_client_secret"
+
+    settings.OIDC_OP_URL = "https://oidc.example.com"
+    settings.OIDC_VERIFY_SSL = False
+    settings.OIDC_TIMEOUT = 5
+    settings.OIDC_PROXY = None
+    settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
+    settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
+    settings.OIDC_RS_SCOPES = ["openid", "groups"]
+    settings.OIDC_RS_ALLOWED_AUDIENCES = ["some_service_provider"]
+
+
+@pytest.fixture
+def resource_server_backend_conf(settings):
+    """
+    A fixture to create a user token for testing.
+    """
+    resource_server_backend_setup(settings)
+    reload_urls()
+
+
+@pytest.fixture
+def resource_server_backend(settings):
+    """
+    A fixture to create a user token for testing.
+    Including a mocked introspection endpoint.
+    """
+    resource_server_backend_setup(settings)
+    reload_urls()
+
+    with responses.RequestsMock() as rsps:
+        rsps.add(
+            responses.POST,
+            "https://oidc.example.com/introspect",
+            json={
+                "iss": "https://oidc.example.com",
+                "aud": "some_client_id",  # settings.OIDC_RS_CLIENT_ID
+                "sub": "very-specific-sub",
+                "client_id": "some_service_provider",
+                "scope": "openid groups",
+                "active": True,
+            },
+        )
+
+        yield rsps
+
+
+@pytest.fixture
+def user_specific_sub():
+    """
+    A fixture to create a user token for testing.
+    """
+    user = factories.UserFactory(sub="very-specific-sub")
+
+    yield user
+
+
+def build_authorization_bearer(token):
+    """
+    Build an Authorization Bearer header value from a token.
+
+    This can be used like this:
+    client.post(
+        ...
+        HTTP_AUTHORIZATION=f"Bearer {build_authorization_bearer('some_token')}",
+    )
+    """
+    return base64.b64encode(token.encode("utf-8")).decode("utf-8")
+
+
+@pytest.fixture
+def user_token():
+    """
+    A fixture to create a user token for testing.
+    """
+    return build_authorization_bearer("some_token")

src/backend/core/tests/external_api/test_external_api_users.py

@@ -0,0 +1,152 @@
+"""
+Tests for the Resource Server API for users.
+
+Not testing external API endpoints that are already tested in the /api
+because the resource server viewsets inherit from the api viewsets.
+
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.api import serializers
+from core.tests.utils.urls import reload_urls
+
+pytestmark = pytest.mark.django_db
+
+# pylint: disable=unused-argument
+
+
+def test_api_users_me_anonymous_public_standalone():
+    """
+    Anonymous users should not be allowed to retrieve their own user information from external
+    API if resource server is not enabled.
+    """
+    reload_urls()
+    response = APIClient().get("/external_api/v1.0/users/me/")
+
+    assert response.status_code == 404
+
+
+def test_api_users_me_connected_not_resource_server():
+    """
+    Connected users should not be allowed to retrieve their own user information from external
+    API if resource server is not enabled.
+    """
+    reload_urls()
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/external_api/v1.0/users/me/")
+
+    assert response.status_code == 404
+
+
+def test_api_users_me_connected_resource_server(
+    user_token, resource_server_backend, user_specific_sub
+):
+    """
+    Connected users should be allowed to retrieve their own user information from external API
+    if resource server is enabled.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    response = client.get("/external_api/v1.0/users/me/")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["id"] == str(user_specific_sub.id)
+    assert data["email"] == user_specific_sub.email
+
+
+def test_api_users_me_connected_resource_server_with_invalid_token(
+    user_token, resource_server_backend
+):
+    """
+    Connected users should not be allowed to retrieve their own user information from external API
+    if resource server is enabled with an invalid token.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    response = client.get("/external_api/v1.0/users/me/")
+
+    assert response.status_code == 401
+
+
+# Non allowed actions on resource server.
+
+
+def test_api_users_list_resource_server_not_allowed(
+    user_token, resource_server_backend, user_specific_sub
+):
+    """
+    Connected users should notbe allowed to list users from a resource server.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    response = client.get("/external_api/v1.0/users/")
+
+    assert response.status_code == 403
+
+
+def test_api_users_retrieve_resource_server_not_allowed(
+    user_token, resource_server_backend, user_specific_sub
+):
+    """
+    Connected users should notbe allowed to list users from a resource server.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    other_user = factories.UserFactory()
+
+    response = client.get(f"/external_api/v1.0/users/{other_user.id!s}/")
+
+    assert response.status_code == 403
+
+
+def test_api_users_put_patch_resource_server_not_allowed(
+    user_token, resource_server_backend, user_specific_sub
+):
+    """
+    Connected users should notbe allowed to list users from a resource server.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    other_user = factories.UserFactory()
+
+    new_user_values = serializers.UserSerializer(instance=factories.UserFactory()).data
+    response = client.put(
+        f"/external_api/v1.0/users/{other_user.id!s}/", new_user_values
+    )
+
+    assert response.status_code == 403
+
+    response = client.patch(
+        f"/external_api/v1.0/users/{other_user.id!s}/",
+        {"email": "new_email@example.com"},
+    )
+
+    assert response.status_code == 403
+
+
+def test_api_users_delete_resource_server_not_allowed(
+    user_token, resource_server_backend, user_specific_sub
+):
+    """
+    Connected users should notbe allowed to list users from a resource server.
+    """
+    client = APIClient()
+    client.credentials(HTTP_AUTHORIZATION=f"Bearer {user_token}")
+
+    other_user = factories.UserFactory()
+
+    response = client.delete(f"/external_api/v1.0/users/{other_user.id!s}/")
+
+    assert response.status_code == 403

src/backend/core/tests/swagger/test_openapi_schema.py

@@ -0,0 +1,42 @@
+"""
+Test suite for generated openapi schema.
+"""
+
+import json
+from io import StringIO
+
+from django.core.management import call_command
+from django.test import Client
+
+import pytest
+
+pytestmark = pytest.mark.django_db
+
+
+def test_openapi_client_schema():
+    """
+    Generated and served OpenAPI client schema should be correct.
+    """
+    # Start by generating the swagger.json file
+    output = StringIO()
+    call_command(
+        "spectacular",
+        "--api-version",
+        "v1.0",
+        "--urlconf",
+        "core.urls",
+        "--format",
+        "openapi-json",
+        "--file",
+        "core/tests/swagger/swagger.json",
+        stdout=output,
+    )
+    assert output.getvalue() == ""
+
+    response = Client().get("/api/v1.0/swagger.json")
+
+    assert response.status_code == 200
+    with open(
+        "core/tests/swagger/swagger.json", "r", encoding="utf-8"
+    ) as expected_schema:
+        assert response.json() == json.load(expected_schema)

src/backend/core/tests/test_api_config.py

@@ -0,0 +1,161 @@
+"""
+Test config API endpoints in the calendars core app.
+"""
+
+import json
+
+from django.test import override_settings
+
+import pytest
+from rest_framework.status import (
+    HTTP_200_OK,
+)
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+@override_settings(
+    FRONTEND_THEME="test-theme",
+    FRONTEND_MORE_LINK="https://test.com",
+    FRONTEND_FEEDBACK_BUTTON_SHOW=True,
+    FRONTEND_FEEDBACK_BUTTON_IDLE=False,
+    FRONTEND_FEEDBACK_ITEMS={"form": {"url": "https://test.com"}},
+    FRONTEND_FEEDBACK_MESSAGES_WIDGET_ENABLED=True,
+    FRONTEND_FEEDBACK_MESSAGES_WIDGET_API_URL="https://test.com",
+    FRONTEND_FEEDBACK_MESSAGES_WIDGET_CHANNEL="test",
+    FRONTEND_FEEDBACK_MESSAGES_WIDGET_PATH="https://test.com",
+    FRONTEND_HIDE_GAUFRE=True,
+    MEDIA_BASE_URL="http://testserver/",
+    SENTRY_DSN="https://sentry.test/123",
+    THEME_CUSTOMIZATION_FILE_PATH="",
+)
+@pytest.mark.parametrize("is_authenticated", [False, True])
+def test_api_config(is_authenticated):
+    """Anonymous users should be allowed to get the configuration."""
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    assert response.json() == {
+        "ENVIRONMENT": "test",
+        "FRONTEND_THEME": "test-theme",
+        "FRONTEND_MORE_LINK": "https://test.com",
+        "FRONTEND_FEEDBACK_BUTTON_SHOW": True,
+        "FRONTEND_FEEDBACK_BUTTON_IDLE": False,
+        "FRONTEND_FEEDBACK_ITEMS": {"form": {"url": "https://test.com"}},
+        "FRONTEND_FEEDBACK_MESSAGES_WIDGET_ENABLED": True,
+        "FRONTEND_FEEDBACK_MESSAGES_WIDGET_API_URL": "https://test.com",
+        "FRONTEND_FEEDBACK_MESSAGES_WIDGET_CHANNEL": "test",
+        "FRONTEND_FEEDBACK_MESSAGES_WIDGET_PATH": "https://test.com",
+        "FRONTEND_HIDE_GAUFRE": True,
+        "LANGUAGES": [
+            ["en-us", "English"],
+            ["fr-fr", "French"],
+            ["de-de", "German"],
+            ["nl-nl", "Dutch"],
+        ],
+        "LANGUAGE_CODE": "en-us",
+        "MEDIA_BASE_URL": "http://testserver/",
+        "SENTRY_DSN": "https://sentry.test/123",
+        "theme_customization": {},
+    }
+
+
+@override_settings(
+    THEME_CUSTOMIZATION_FILE_PATH="/not/existing/file.json",
+)
+@pytest.mark.parametrize("is_authenticated", [False, True])
+def test_api_config_with_invalid_theme_customization_file(is_authenticated):
+    """Anonymous users should be allowed to get the configuration."""
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+    assert content["theme_customization"] == {}
+
+
+@override_settings(
+    THEME_CUSTOMIZATION_FILE_PATH="/configuration/theme/invalid.json",
+)
+@pytest.mark.parametrize("is_authenticated", [False, True])
+def test_api_config_with_invalid_json_theme_customization_file(is_authenticated, fs):
+    """Anonymous users should be allowed to get the configuration."""
+    fs.create_file(
+        "/configuration/theme/invalid.json",
+        contents="invalid json",
+    )
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+    assert content["theme_customization"] == {}
+
+
+@override_settings(
+    THEME_CUSTOMIZATION_FILE_PATH="/configuration/theme/default.json",
+)
+@pytest.mark.parametrize("is_authenticated", [False, True])
+def test_api_config_with_theme_customization(is_authenticated, fs):
+    """Anonymous users should be allowed to get the configuration."""
+    fs.create_file(
+        "/configuration/theme/default.json",
+        contents=json.dumps(
+            {
+                "colors": {
+                    "primary": "#000000",
+                    "secondary": "#000000",
+                },
+            }
+        ),
+    )
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+    assert content["theme_customization"] == {
+        "colors": {
+            "primary": "#000000",
+            "secondary": "#000000",
+        },
+    }
+
+
+@pytest.mark.parametrize("is_authenticated", [False, True])
+def test_api_config_with_original_theme_customization(is_authenticated, settings):
+    """Anonymous users should be allowed to get the configuration."""
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+
+    with open(settings.THEME_CUSTOMIZATION_FILE_PATH, "r", encoding="utf-8") as f:
+        theme_customization = json.load(f)
+
+    assert content["theme_customization"] == theme_customization

src/backend/core/tests/test_api_users.py

@@ -0,0 +1,638 @@
+"""
+Test users API endpoints in the calendars core app.
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_users_list_anonymous():
+    """Anonymous users should not be allowed to list users."""
+    factories.UserFactory()
+    client = APIClient()
+    response = client.get("/api/v1.0/users/")
+    assert response.status_code == 401
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "not_authenticated",
+                "detail": "Authentication credentials were not provided.",
+            },
+        ],
+        "type": "client_error",
+    }
+
+
+def test_api_users_list_authenticated():
+    """
+    Authenticated users should not be able to list users without a query.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    factories.UserFactory.create_batch(2)
+    response = client.get(
+        "/api/v1.0/users/",
+    )
+    assert response.status_code == 200
+    assert response.json() == []
+
+
+def test_api_users_list_query_inactive():
+    """Inactive users should not be listed."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.UserFactory(email="john.doe@example.com", is_active=False)
+    lennon = factories.UserFactory(email="john.lennon@example.com")
+
+    # Use email query to get exact match
+    response = client.get("/api/v1.0/users/?q=john.lennon@example.com")
+
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == [str(lennon.id)]
+
+    # Inactive user should not be returned even with exact match
+    response = client.get("/api/v1.0/users/?q=john.doe@example.com")
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == []
+
+
+def test_api_users_list_query_short_queries():
+    """
+    Queries shorter than 5 characters should return an empty result set.
+    """
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.UserFactory(email="john.doe@example.com")
+    factories.UserFactory(email="john.lennon@example.com")
+
+    response = client.get("/api/v1.0/users/?q=jo")
+    assert response.status_code == 200
+    assert response.json() == []
+
+    response = client.get("/api/v1.0/users/?q=john")
+    assert response.status_code == 200
+    assert response.json() == []
+
+    # Non-email queries (without @) return empty
+    response = client.get("/api/v1.0/users/?q=john.")
+    assert response.status_code == 200
+    assert response.json() == []
+
+
+def test_api_users_list_limit(settings):
+    """
+    Authenticated users should be able to list users and the number of results
+    should be limited to 10.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    # Use a base name with a length equal 5 to test that the limit is applied
+    base_name = "alice"
+    for i in range(15):
+        factories.UserFactory(email=f"{base_name}.{i}@example.com")
+
+    # Non-email queries (without @) return empty
+    response = client.get(
+        "/api/v1.0/users/?q=alice",
+    )
+    assert response.status_code == 200
+    assert response.json() == []
+
+    # Email queries require exact match
+    settings.API_USERS_LIST_LIMIT = 100
+    response = client.get(
+        "/api/v1.0/users/?q=alice.0@example.com",
+    )
+    assert response.status_code == 200
+    assert len(response.json()) == 1
+
+
+def test_api_users_list_throttling_authenticated(settings):
+    """
+    Authenticated users should be throttled.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["user_list_burst"] = "3/minute"
+
+    for _i in range(3):
+        response = client.get(
+            "/api/v1.0/users/?q=alice",
+        )
+        assert response.status_code == 200
+
+    response = client.get(
+        "/api/v1.0/users/?q=alice",
+    )
+    assert response.status_code == 429
+
+
+def test_api_users_list_query_email():
+    """
+    Authenticated users should be able to list users and filter by email.
+    Only exact email matches are returned (case-insensitive).
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    dave = factories.UserFactory(email="david.bowman@work.com")
+    factories.UserFactory(email="nicole.bowman@work.com")
+
+    # Exact match works
+    response = client.get(
+        "/api/v1.0/users/?q=david.bowman@work.com",
+    )
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == [str(dave.id)]
+
+    # Case-insensitive match works
+    response = client.get(
+        "/api/v1.0/users/?q=David.Bowman@Work.COM",
+    )
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == [str(dave.id)]
+
+    # Typos don't match (exact match only)
+    response = client.get(
+        "/api/v1.0/users/?q=davig.bovman@worm.com",
+    )
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == []
+
+    response = client.get(
+        "/api/v1.0/users/?q=davig.bovman@worm.cop",
+    )
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == []
+
+
+def test_api_users_list_query_email_matching():
+    """Email queries return exact matches only (case-insensitive)."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    user1 = factories.UserFactory(email="alice.johnson@example.gouv.fr")
+    user2 = factories.UserFactory(email="alice.johnnson@example.gouv.fr")
+    user3 = factories.UserFactory(email="alice.kohlson@example.gouv.fr")
+    user4 = factories.UserFactory(email="alicia.johnnson@example.gouv.fr")
+    user5 = factories.UserFactory(email="alicia.johnnson@example.gov.uk")
+    factories.UserFactory(email="alice.thomson@example.gouv.fr")
+
+    # Exact match returns only that user
+    response = client.get(
+        "/api/v1.0/users/?q=alice.johnson@example.gouv.fr",
+    )
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == [str(user1.id)]
+
+    # Different email returns different user
+    response = client.get("/api/v1.0/users/?q=alicia.johnnson@example.gouv.fr")
+    assert response.status_code == 200
+    user_ids = [user["id"] for user in response.json()]
+    assert user_ids == [str(user4.id)]
+
+
+def test_api_users_retrieve_me_anonymous():
+    """Anonymous users should not be allowed to list users."""
+    factories.UserFactory.create_batch(2)
+    client = APIClient()
+    response = client.get("/api/v1.0/users/me/")
+    assert response.status_code == 401
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "not_authenticated",
+                "detail": "Authentication credentials were not provided.",
+            },
+        ],
+        "type": "client_error",
+    }
+
+
+def test_api_users_retrieve_me_authenticated():
+    """Authenticated users should be able to retrieve their own user via the "/users/me" path."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    factories.UserFactory.create_batch(2)
+    response = client.get(
+        "/api/v1.0/users/me/",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(user.id),
+        "email": user.email,
+        "full_name": user.full_name,
+        "short_name": user.short_name,
+        "language": user.language,
+    }
+
+
+def test_api_users_retrieve_anonymous():
+    """Anonymous users should not be allowed to retrieve a user."""
+    client = APIClient()
+    user = factories.UserFactory()
+    response = client.get(f"/api/v1.0/users/{user.id!s}/")
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "not_authenticated",
+                "detail": "Authentication credentials were not provided.",
+            },
+        ],
+        "type": "client_error",
+    }
+
+
+def test_api_users_retrieve_authenticated_self():
+    """
+    Authenticated users should be allowed to retrieve their own user.
+    The returned object should not contain the password.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/users/{user.id!s}/",
+    )
+    assert response.status_code == 405
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "method_not_allowed",
+                "detail": 'Method "GET" not allowed.',
+            },
+        ],
+        "type": "client_error",
+    }
+
+
+def test_api_users_retrieve_authenticated_other():
+    """
+    Authenticated users should be able to retrieve another user's detail view with
+    limited information.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+
+    response = client.get(
+        f"/api/v1.0/users/{other_user.id!s}/",
+    )
+    assert response.status_code == 405
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "method_not_allowed",
+                "detail": 'Method "GET" not allowed.',
+            },
+        ],
+        "type": "client_error",
+    }
+
+
+def test_api_users_create_anonymous():
+    """Anonymous users should not be able to create users via the API."""
+    response = APIClient().post(
+        "/api/v1.0/users/",
+        {
+            "language": "fr-fr",
+            "password": "mypassword",
+        },
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "not_authenticated",
+                "detail": "Authentication credentials were not provided.",
+            },
+        ],
+        "type": "client_error",
+    }
+
+    assert models.User.objects.exists() is False
+
+
+def test_api_users_create_authenticated():
+    """Authenticated users should not be able to create users via the API."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        "/api/v1.0/users/",
+        {
+            "language": "fr-fr",
+            "password": "mypassword",
+        },
+        format="json",
+    )
+    assert response.status_code == 405
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "method_not_allowed",
+                "detail": 'Method "POST" not allowed.',
+            },
+        ],
+        "type": "client_error",
+    }
+
+    assert models.User.objects.exclude(id=user.id).exists() is False
+
+
+def test_api_users_update_anonymous():
+    """Anonymous users should not be able to update users via the API."""
+    user = factories.UserFactory()
+
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = serializers.UserSerializer(instance=factories.UserFactory()).data
+
+    response = APIClient().put(
+        f"/api/v1.0/users/{user.id!s}/",
+        new_user_values,
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "errors": [
+            {
+                "attr": None,
+                "code": "not_authenticated",
+                "detail": "Authentication credentials were not provided.",
+            },
+        ],
+        "type": "client_error",
+    }
+
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        assert value == old_user_values[key]
+
+
+def test_api_users_update_authenticated_self():
+    """
+    Authenticated users should be able to update their own user but only "language"
+    and "timezone" fields.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = dict(
+        serializers.UserSerializer(instance=factories.UserFactory()).data
+    )
+
+    response = client.put(
+        f"/api/v1.0/users/{user.id!s}/",
+        new_user_values,
+        format="json",
+    )
+
+    assert response.status_code == 200
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        if key in ["language", "timezone"]:
+            assert value == new_user_values[key]
+        else:
+            assert value == old_user_values[key]
+
+
+def test_api_users_update_authenticated_other():
+    """Authenticated users should not be allowed to update other users."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    user = factories.UserFactory()
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = serializers.UserSerializer(instance=factories.UserFactory()).data
+
+    response = client.put(
+        f"/api/v1.0/users/{user.id!s}/",
+        new_user_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        assert value == old_user_values[key]
+
+
+def test_api_users_patch_anonymous():
+    """Anonymous users should not be able to patch users via the API."""
+    user = factories.UserFactory()
+
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = dict(
+        serializers.UserSerializer(instance=factories.UserFactory()).data
+    )
+
+    for key, new_value in new_user_values.items():
+        response = APIClient().patch(
+            f"/api/v1.0/users/{user.id!s}/",
+            {key: new_value},
+            format="json",
+        )
+        assert response.status_code == 401
+        assert response.json() == {
+            "errors": [
+                {
+                    "attr": None,
+                    "code": "not_authenticated",
+                    "detail": "Authentication credentials were not provided.",
+                },
+            ],
+            "type": "client_error",
+        }
+
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        assert value == old_user_values[key]
+
+
+def test_api_users_patch_authenticated_self():
+    """
+    Authenticated users should be able to patch their own user but only "language"
+    and "timezone" fields.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = dict(
+        serializers.UserSerializer(instance=factories.UserFactory()).data
+    )
+
+    for key, new_value in new_user_values.items():
+        response = client.patch(
+            f"/api/v1.0/users/{user.id!s}/",
+            {key: new_value},
+            format="json",
+        )
+        assert response.status_code == 200
+
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        if key in ["language", "timezone"]:
+            assert value == new_user_values[key]
+        else:
+            assert value == old_user_values[key]
+
+
+def test_api_users_patch_authenticated_other():
+    """Authenticated users should not be allowed to patch other users."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    user = factories.UserFactory()
+    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+    new_user_values = dict(
+        serializers.UserSerializer(instance=factories.UserFactory()).data
+    )
+
+    for key, new_value in new_user_values.items():
+        response = client.put(
+            f"/api/v1.0/users/{user.id!s}/",
+            {key: new_value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=user).data)
+    for key, value in user_values.items():
+        assert value == old_user_values[key]
+
+
+def test_api_users_delete_list_anonymous():
+    """Anonymous users should not be allowed to delete a list of users."""
+    factories.UserFactory.create_batch(2)
+
+    client = APIClient()
+    response = client.delete("/api/v1.0/users/")
+
+    assert response.status_code == 401
+    assert models.User.objects.count() == 2
+
+
+def test_api_users_delete_list_authenticated():
+    """Authenticated users should not be allowed to delete a list of users."""
+    factories.UserFactory.create_batch(2)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        "/api/v1.0/users/",
+    )
+
+    assert response.status_code == 405
+    assert models.User.objects.count() == 3
+
+
+def test_api_users_delete_anonymous():
+    """Anonymous users should not be allowed to delete a user."""
+    user = factories.UserFactory()
+
+    response = APIClient().delete(f"/api/v1.0/users/{user.id!s}/")
+
+    assert response.status_code == 401
+    assert models.User.objects.count() == 1
+
+
+def test_api_users_delete_authenticated():
+    """
+    Authenticated users should not be allowed to delete a user other than themselves.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+
+    response = client.delete(
+        f"/api/v1.0/users/{other_user.id!s}/",
+    )
+
+    assert response.status_code == 405
+    assert models.User.objects.count() == 2
+
+
+def test_api_users_delete_self():
+    """Authenticated users should not be able to delete their own user."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/users/{user.id!s}/",
+    )
+
+    assert response.status_code == 405
+    assert models.User.objects.count() == 1

src/backend/core/tests/test_caldav_service.py

@@ -0,0 +1,71 @@
+"""Tests for CalDAV service integration with DAViCal."""
+
+from unittest.mock import Mock, patch
+
+from django.conf import settings
+
+import pytest
+
+from core import factories
+from core.services.caldav_service import CalendarService, DAViCalClient
+
+
+@pytest.mark.django_db
+class TestDAViCalClient:
+    """Tests for DAViCalClient authentication and communication."""
+
+    def test_get_client_sends_x_forwarded_user_header(self):
+        """Test that DAVClient is configured with X-Forwarded-User header."""
+        user = factories.UserFactory(email="test@example.com")
+        client = DAViCalClient()
+
+        dav_client = client._get_client(user)
+
+        # Verify the client is configured correctly
+        assert dav_client.username == user.email
+        # Password should be empty (None or empty string) for external auth
+        assert not dav_client.password or dav_client.password == ""
+
+        # Verify the X-Forwarded-User header is set
+        # The caldav library stores headers as a CaseInsensitiveDict
+        assert hasattr(dav_client, "headers")
+        assert "X-Forwarded-User" in dav_client.headers
+        assert dav_client.headers["X-Forwarded-User"] == user.email
+
+    @pytest.mark.skipif(
+        not getattr(settings, "DAVICAL_URL", None),
+        reason="DAViCal URL not configured",
+    )
+    def test_create_calendar_authenticates_with_davical(self):
+        """Test that calendar creation authenticates successfully with DAViCal."""
+        user = factories.UserFactory(email="test@example.com")
+        client = DAViCalClient()
+
+        # Ensure user exists in DAViCal
+        client.ensure_user_exists(user)
+
+        # Try to create a calendar - this should authenticate successfully
+        calendar_path = client.create_calendar(
+            user, calendar_name="Test Calendar", calendar_id="test-calendar-id"
+        )
+
+        # Verify calendar path was returned
+        assert calendar_path is not None
+        assert calendar_path.startswith("/caldav.php/")
+        assert user.email in calendar_path
+
+    def test_calendar_service_creates_calendar(self):
+        """Test that CalendarService can create a calendar through DAViCal."""
+        user = factories.UserFactory(email="test@example.com")
+        service = CalendarService()
+
+        # Create a calendar
+        calendar = service.create_calendar(user, name="My Calendar", color="#ff0000")
+
+        # Verify calendar was created
+        assert calendar is not None
+        assert calendar.owner == user
+        assert calendar.name == "My Calendar"
+        assert calendar.color == "#ff0000"
+        assert calendar.davical_path is not None
+        assert calendar.davical_path.startswith("/caldav.php/")

src/backend/core/tests/test_models_users.py

@@ -0,0 +1,46 @@
+"""
+Unit tests for the User model
+"""
+
+from unittest import mock
+
+from django.core.exceptions import ValidationError
+
+import pytest
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_models_users_str():
+    """The str representation should be the email."""
+    user = factories.UserFactory()
+    assert str(user) == user.email
+
+
+def test_models_users_id_unique():
+    """The "id" field should be unique."""
+    user = factories.UserFactory()
+    with pytest.raises(ValidationError, match="User with this Id already exists."):
+        factories.UserFactory(id=user.id)
+
+
+def test_models_users_send_mail_main_existing():
+    """The "email_user' method should send mail to the user's email address."""
+    user = factories.UserFactory()
+
+    with mock.patch("django.core.mail.send_mail") as mock_send:
+        user.email_user("my subject", "my message")
+
+    mock_send.assert_called_once_with("my subject", "my message", None, [user.email])
+
+
+def test_models_users_send_mail_main_missing():
+    """The "email_user' method should fail if the user has no email address."""
+    user = factories.UserFactory(email=None)
+
+    with pytest.raises(ValueError) as excinfo:
+        user.email_user("my subject", "my message")
+
+    assert str(excinfo.value) == "User has no email address."

src/backend/core/tests/test_settings.py

@@ -0,0 +1,30 @@
+"""
+Unit tests for the User model
+"""
+
+import pytest
+
+from calendars.settings import Base
+
+
+def test_invalid_settings_oidc_email_configuration():
+    """
+    The OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION and OIDC_ALLOW_DUPLICATE_EMAILS settings
+    should not be both set to True simultaneously.
+    """
+
+    class TestSettings(Base):
+        """Fake test settings."""
+
+        OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = True
+        OIDC_ALLOW_DUPLICATE_EMAILS = True
+
+    # The validation is performed during post_setup
+    with pytest.raises(ValueError) as excinfo:
+        TestSettings().post_setup()
+
+    # Check the exception message
+    assert str(excinfo.value) == (
+        "Both OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION and "
+        "OIDC_ALLOW_DUPLICATE_EMAILS cannot be set to True simultaneously. "
+    )

src/backend/core/tests/utils/urls.py

@@ -0,0 +1,20 @@
+"""Utils for testing URLs."""
+
+import importlib
+
+from django.urls import clear_url_caches
+
+
+def reload_urls():
+    """
+    Reload the URLs. Since the url are loaded based on a
+    settings value, we need to reload the urls to make the
+    URL settings based condition effective.
+    """
+    import core.urls  # pylint:disable=import-outside-toplevel # noqa: PLC0415
+
+    import calendars.urls  # pylint:disable=import-outside-toplevel # noqa: PLC0415
+
+    importlib.reload(core.urls)
+    importlib.reload(calendars.urls)
+    clear_url_caches()