API: Calendar feeds

Every member can turn a task VIEW — a list, or one of the smart filters — into an iCalendar (RFC 5545) feed of its due-dated pending tasks, rendered as all-day events. Feeds carry titles and dates only — never descriptions. Feeds are per user AND per view.

A view is addressed as:

View	view value
a list	list:{listId}
all tasks	all
assigned to me	assignedToMe
unassigned	unassigned
past due	pastDue
due soon (next 7 days)	dueSoon

assignedToMe always means the feed’s OWNER; pastDue/dueSoon windows are evaluated at fetch time against the UTC calendar day.

Mint (or rotate) a feed token

POST /api/workspaces/{workspaceId}/calendar-feed

{ "view": "assignedToMe", "name": "Assigned to me" }

name is the view’s display name in the caller’s language — snapshotted for filter feeds (list feeds always render their live list name). Returns 201:

{ "token": "tdmcal_…", "path": "/api/calendar/tdmcal_…" }

The token (256-bit random, tdmcal_ prefix) is shown exactly once — the server stores only its hash. Minting again for the same view ROTATES: the previous token stops working immediately.

Feed status

GET /api/workspaces/{workspaceId}/calendar-feed?view={view}

Returns { "active": true, "createdAt": "…" } — never the token itself.

Revoke

DELETE /api/workspaces/{workspaceId}/calendar-feed?view={view}

Returns 204; idempotent.

The public feed

GET /api/calendar/{token}

Unauthenticated — the token is the credential. Serves text/calendar. Authorization is re-checked on every fetch: if the member leaves the workspace, or the list or account is deleted, the feed answers 404, the same as an unknown or rotated token.

One-shot download

GET /api/workspaces/{workspaceId}/calendar.ics?view={view}&name={name}

Session-authenticated; returns the same iCalendar document as an attachment (name labels filter views). A snapshot — unlike the feed, it never updates.