rproxy: pass WebDAV methods on (closes #278)

rproxy now passes PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT,
SEARCH, LOCK and UNLOCK to discriminator instead of answering 405, so
Nextcloud's Files app and sync client work. The Core Rule Set's 911100
still refuses them wherever no app's exclusions allow them.

Model: opus-5-5

SPEC.md

@@ -1943,10 +1943,23 @@ image runs it by default (see "Deployment").
 - `DELETE`
 - `PATCH`
 - `QUERY`
+- `PROPFIND`
+- `PROPPATCH`
+- `MKCOL`
+- `COPY`
+- `MOVE`
+- `REPORT`
+- `SEARCH`
+- `LOCK`
+- `UNLOCK`
 
 It answers any other method `405`, with no question and no report. The answer's
 `Allow` header names these methods.
 
+Nextcloud's Files app and sync client use the last nine, which are WebDAV
+methods. The Core Rule Set refuses them except where an app's exclusions allow
+them.
+
 `rproxy` answers `400`, with no question and no report, to a request with:
 
 - a target that does not start with `/`, such as `x:admin`,

internal/rproxy/question_test.go

@@ -331,7 +331,7 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	t.Parallel()
 
-	for _, method := range []string{http.MethodTrace, "PROPFIND", "LOCK", "BREW"} {
+	for _, method := range []string{http.MethodTrace, "MKCALENDAR", "BREW"} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
@@ -343,7 +343,8 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 
 			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
 			if got.status != http.StatusMethodNotAllowed ||
-				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY" {
+				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, "+
+					"PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK, UNLOCK" {
 				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
 			}
 
@@ -368,6 +369,8 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 	for _, method := range []string{
 		http.MethodGet, http.MethodHead, http.MethodPost, http.MethodOptions,
 		http.MethodPut, http.MethodDelete, http.MethodPatch, "QUERY",
+		"PROPFIND", "PROPPATCH", "MKCOL", "COPY", "MOVE", "REPORT", "SEARCH",
+		"LOCK", "UNLOCK",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()

internal/rproxy/rproxy.go

@@ -51,7 +51,9 @@ const ownEndpointPrefix = "/_sww/"
 
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
-const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY"
+// The WebDAV ones are for Nextcloud.
+const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY, " +
+	"PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK, UNLOCK"
 
 // Params are what New needs.
 type Params struct {