WebDAV: Reduce quota excess risk with lower TOCTOU window

crates/dav/src/calendar/update.rs

@@ -167,17 +167,6 @@ impl CalendarUpdateRequestHandler for Server {
                 return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
             }
 
-            // Validate quota
-            let extra_bytes =
-                (bytes.len() as u64).saturating_sub(u32::from(event.inner.size) as u64);
-            if extra_bytes > 0 {
-                self.has_available_quota(
-                    &self.get_resource_token(access_token, account_id).await?,
-                    extra_bytes,
-                )
-                .await?;
-            }
-
             // Validate iCal
             if event.inner.data.event.uids().next().unwrap_or_default() != validate_ical(&ical)? {
                 return Err(DavError::Condition(DavErrorCondition::new(
@@ -278,6 +267,17 @@ impl CalendarUpdateRequestHandler for Server {
             }
             let nudge_queue = next_email_alarm.is_some() || itip_messages.is_some();
 
+            // Validate quota
+            let extra_bytes =
+                (bytes.len() as u64).saturating_sub(u32::from(event.inner.size) as u64);
+            if extra_bytes > 0 {
+                self.has_available_quota(
+                    &self.get_resource_token(access_token, account_id).await?,
+                    extra_bytes,
+                )
+                .await?;
+            }
+
             // Prepare write batch
             let mut batch = BatchBuilder::new();
             let schedule_tag = new_event.schedule_tag;
@@ -338,15 +338,6 @@ impl CalendarUpdateRequestHandler for Server {
             )
             .await?;
 
-            // Validate quota
-            if !bytes.is_empty() {
-                self.has_available_quota(
-                    &self.get_resource_token(access_token, account_id).await?,
-                    bytes.len() as u64,
-                )
-                .await?;
-            }
-
             // Validate ical object
             assert_is_unique_uid(
                 self,
@@ -410,6 +401,15 @@ impl CalendarUpdateRequestHandler for Server {
             }
             let nudge_queue = next_email_alarm.is_some() || itip_messages.is_some();
 
+            // Validate quota
+            if !bytes.is_empty() {
+                self.has_available_quota(
+                    &self.get_resource_token(access_token, account_id).await?,
+                    bytes.len() as u64,
+                )
+                .await?;
+            }
+
             // Prepare write batch
             let mut batch = BatchBuilder::new();
             let document_id = self

crates/dav/src/card/update.rs

@@ -152,17 +152,6 @@ impl CardUpdateRequestHandler for Server {
                 Err(e) => return Err(e),
             }
 
-            // Validate quota
-            let extra_bytes =
-                (bytes.len() as u64).saturating_sub(u32::from(card.inner.size) as u64);
-            if extra_bytes > 0 {
-                self.has_available_quota(
-                    &self.get_resource_token(access_token, account_id).await?,
-                    extra_bytes,
-                )
-                .await?;
-            }
-
             // Validate UID
             match (card.inner.card.uid(), vcard.uid()) {
                 (Some(old_uid), Some(new_uid)) if old_uid == new_uid => {}
@@ -175,6 +164,17 @@ impl CardUpdateRequestHandler for Server {
                 }
             }
 
+            // Validate quota
+            let extra_bytes =
+                (bytes.len() as u64).saturating_sub(u32::from(card.inner.size) as u64);
+            if extra_bytes > 0 {
+                self.has_available_quota(
+                    &self.get_resource_token(access_token, account_id).await?,
+                    extra_bytes,
+                )
+                .await?;
+            }
+
             // Build node
             let mut new_card = card
                 .deserialize::<ContactCard>()
@@ -223,15 +223,6 @@ impl CardUpdateRequestHandler for Server {
             )
             .await?;
 
-            // Validate quota
-            if !bytes.is_empty() {
-                self.has_available_quota(
-                    &self.get_resource_token(access_token, account_id).await?,
-                    bytes.len() as u64,
-                )
-                .await?;
-            }
-
             // Validate UID
             assert_is_unique_uid(
                 self,
@@ -242,6 +233,15 @@ impl CardUpdateRequestHandler for Server {
             )
             .await?;
 
+            // Validate quota
+            if !bytes.is_empty() {
+                self.has_available_quota(
+                    &self.get_resource_token(access_token, account_id).await?,
+                    bytes.len() as u64,
+                )
+                .await?;
+            }
+
             // Build node
             let card = ContactCard {
                 names: vec![DavName {