[CalendarServer-changes] [12663] CalendarServer/trunk

source_changes at macosforge.org source_changes at macosforge.org
Wed Mar 12 11:22:12 PDT 2014


Revision: 12663
          http://trac.calendarserver.org//changeset/12663
Author:   sagen at apple.com
Date:     2014-02-11 16:30:58 -0800 (Tue, 11 Feb 2014)
Log Message:
-----------
New group cacher based on twext.who; delegates in the store

Modified Paths:
--------------
    CalendarServer/trunk/calendarserver/tap/caldav.py
    CalendarServer/trunk/calendarserver/tools/principals.py
    CalendarServer/trunk/calendarserver/tools/util.py
    CalendarServer/trunk/twistedcaldav/directory/directory.py
    CalendarServer/trunk/twistedcaldav/directory/test/test_directory.py
    CalendarServer/trunk/twistedcaldav/stdconfig.py
    CalendarServer/trunk/txdav/common/datastore/sql.py
    CalendarServer/trunk/txdav/common/datastore/sql_schema/current-oracle-dialect.sql
    CalendarServer/trunk/txdav/common/datastore/sql_schema/current.sql

Added Paths:
-----------
    CalendarServer/trunk/txdav/common/datastore/sql_schema/old/oracle-dialect/v34.sql
    CalendarServer/trunk/txdav/common/datastore/sql_schema/old/postgres-dialect/v34.sql
    CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/oracle-dialect/upgrade_from_34_to_35.sql
    CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/postgres-dialect/upgrade_from_34_to_35.sql
    CalendarServer/trunk/txdav/who/delegates.py
    CalendarServer/trunk/txdav/who/groups.py
    CalendarServer/trunk/txdav/who/test/accounts/
    CalendarServer/trunk/txdav/who/test/accounts/accounts.xml
    CalendarServer/trunk/txdav/who/test/accounts/resources.xml
    CalendarServer/trunk/txdav/who/test/test_delegates.py
    CalendarServer/trunk/txdav/who/test/test_groups.py

Modified: CalendarServer/trunk/calendarserver/tap/caldav.py
===================================================================
--- CalendarServer/trunk/calendarserver/tap/caldav.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/calendarserver/tap/caldav.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -78,12 +78,14 @@
     UpgradeAcquireLockStep, UpgradeReleaseLockStep, UpgradeDatabaseNotificationDataStep)
 from txdav.common.datastore.work.revision_cleanup import scheduleFirstFindMinRevision
 from txdav.dps.server import DirectoryProxyServiceMaker
+from txdav.dps.client import DirectoryService as DirectoryProxyClientService
+from txdav.who.groups import GroupCacher as NewGroupCacher
 
 from twistedcaldav import memcachepool
 from twistedcaldav.config import config, ConfigurationError
 from twistedcaldav.directory import calendaruserproxy
 from twistedcaldav.directory.directory import GroupMembershipCacheUpdater
-from twistedcaldav.directory.directory import scheduleNextGroupCachingUpdate
+from txdav.who.groups import scheduleNextGroupCachingUpdate
 from twistedcaldav.localization import processLocalizationFiles
 from twistedcaldav.stdconfig import DEFAULT_CONFIG, DEFAULT_CONFIG_FILE
 from twistedcaldav.upgrade import UpgradeFileSystemFormatStep, PostDBImportStep
@@ -1239,9 +1241,11 @@
                     config.GroupCaching.LockSeconds,
                     namespace=config.GroupCaching.MemcachedPool,
                     useExternalProxies=config.GroupCaching.UseExternalProxies
-                    )
+                )
+                newGroupCacher = NewGroupCacher(DirectoryProxyClientService(None))
             else:
                 groupCacher = None
+                newGroupCacher = None
 
             # Optionally enable Manhole access
             if config.Manhole.Enabled:
@@ -1275,6 +1279,7 @@
                 txn._rootResource = result.rootResource
                 txn._mailRetriever = mailRetriever
                 txn._groupCacher = groupCacher
+                txn._newGroupCacher = newGroupCacher
 
             store.callWithNewTransactions(decorateTransaction)
 

Modified: CalendarServer/trunk/calendarserver/tools/principals.py
===================================================================
--- CalendarServer/trunk/calendarserver/tools/principals.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/calendarserver/tools/principals.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -31,7 +31,7 @@
 
 from twistedcaldav.config import config
 from twistedcaldav.directory.directory import UnknownRecordTypeError, DirectoryError
-from twistedcaldav.directory.directory import schedulePolledGroupCachingUpdate
+from txdav.who.groups import schedulePolledGroupCachingUpdate
 
 from calendarserver.tools.util import (
     booleanArgument, proxySubprincipal, action_addProxyPrincipal,

Modified: CalendarServer/trunk/calendarserver/tools/util.py
===================================================================
--- CalendarServer/trunk/calendarserver/tools/util.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/calendarserver/tools/util.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -50,7 +50,7 @@
 from twistedcaldav.directory import calendaruserproxy
 from twistedcaldav.directory.aggregate import AggregateDirectoryService
 from twistedcaldav.directory.directory import DirectoryService, DirectoryRecord
-from twistedcaldav.directory.directory import schedulePolledGroupCachingUpdate
+from txdav.who.groups import schedulePolledGroupCachingUpdate
 from calendarserver.push.notifier import NotifierFactory
 
 from txdav.common.datastore.file import CommonDataStore

Modified: CalendarServer/trunk/twistedcaldav/directory/directory.py
===================================================================
--- CalendarServer/trunk/twistedcaldav/directory/directory.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/twistedcaldav/directory/directory.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -31,9 +31,6 @@
 
 from plistlib import readPlistFromString
 
-from twext.enterprise.dal.record import fromTable
-from twext.enterprise.dal.syntax import Delete
-from twext.enterprise.queue import WorkItem, PeerConnectionPool
 from twext.python.log import Logger
 from txweb2.dav.auth import IPrincipalCredentials
 from txweb2.dav.util import joinURL
@@ -52,7 +49,6 @@
 
 from txdav.caldav.icalendardirectoryservice import ICalendarStoreDirectoryService, \
     ICalendarStoreDirectoryRecord
-from txdav.common.datastore.sql_tables import schema
 
 from xml.parsers.expat import ExpatError
 
@@ -1041,61 +1037,8 @@
 
 
 
-class GroupCacherPollingWork(WorkItem, fromTable(schema.GROUP_CACHER_POLLING_WORK)):
 
-    group = "group_cacher_polling"
 
-    @inlineCallbacks
-    def doWork(self):
-
-        # Delete all other work items
-        yield Delete(From=self.table, Where=None).on(self.transaction)
-
-        groupCacher = getattr(self.transaction, "_groupCacher", None)
-        if groupCacher is not None:
-
-            # Schedule next update
-            notBefore = (datetime.datetime.utcnow() +
-                datetime.timedelta(seconds=groupCacher.updateSeconds))
-            log.debug("Scheduling next group cacher update: %s" % (notBefore,))
-            yield self.transaction.enqueue(GroupCacherPollingWork,
-                notBefore=notBefore)
-
-            try:
-                groupCacher.updateCache()
-            except Exception, e:
-                log.error("Failed to update group membership cache (%s)" % (e,))
-
-        else:
-            notBefore = (datetime.datetime.utcnow() +
-                datetime.timedelta(seconds=10))
-            log.debug("Rescheduling group cacher update: %s" % (notBefore,))
-            yield self.transaction.enqueue(GroupCacherPollingWork,
-                notBefore=notBefore)
-
-
-
- at inlineCallbacks
-def scheduleNextGroupCachingUpdate(store, seconds):
-    txn = store.newTransaction()
-    notBefore = datetime.datetime.utcnow() + datetime.timedelta(seconds=seconds)
-    log.debug("Scheduling next group cacher update: %s" % (notBefore,))
-    wp = (yield txn.enqueue(GroupCacherPollingWork, notBefore=notBefore))
-    yield txn.commit()
-    returnValue(wp)
-
-
-
-def schedulePolledGroupCachingUpdate(store):
-    """
-    Schedules a group caching update work item in "the past" so PeerConnectionPool's
-    overdue-item logic picks it up quickly.
-    """
-    seconds = -PeerConnectionPool.queueProcessTimeout
-    return scheduleNextGroupCachingUpdate(store, seconds)
-
-
-
 def diffAssignments(old, new):
     """
     Compare two proxy assignment lists and return their differences in the form of

Modified: CalendarServer/trunk/twistedcaldav/directory/test/test_directory.py
===================================================================
--- CalendarServer/trunk/twistedcaldav/directory/test/test_directory.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/twistedcaldav/directory/test/test_directory.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -20,13 +20,12 @@
 from twistedcaldav.test.util import TestCase
 from twistedcaldav.test.util import xmlFile, augmentsFile, proxiesFile, dirTest
 from twistedcaldav.config import config
-from twistedcaldav.directory.directory import DirectoryService, DirectoryRecord, GroupMembershipCache, GroupMembershipCacheUpdater, diffAssignments, schedulePolledGroupCachingUpdate
+from twistedcaldav.directory.directory import DirectoryService, DirectoryRecord, GroupMembershipCache, GroupMembershipCacheUpdater, diffAssignments
 from twistedcaldav.directory.xmlfile import XMLDirectoryService
 from twistedcaldav.directory.calendaruserproxyloader import XMLCalendarUserProxyLoader
 from twistedcaldav.directory import augment, calendaruserproxy
 from twistedcaldav.directory.util import normalizeUUID
 from twistedcaldav.directory.principal import DirectoryPrincipalProvisioningResource
-from txdav.common.datastore.test.util import buildStore
 
 import cPickle as pickle
 import uuid
@@ -926,25 +925,25 @@
         )
 
 
-    @inlineCallbacks
-    def testScheduling(self):
-        """
-        Exercise schedulePolledGroupCachingUpdate
-        """
+    # @inlineCallbacks
+    # def testScheduling(self):
+    #     """
+    #     Exercise schedulePolledGroupCachingUpdate
+    #     """
 
-        groupCacher = StubGroupCacher()
+    #     groupCacher = StubGroupCacher()
 
 
-        def decorateTransaction(txn):
-            txn._groupCacher = groupCacher
+    #     def decorateTransaction(txn):
+    #         txn._groupCacher = groupCacher
 
-        store = yield buildStore(self, None)
-        store.callWithNewTransactions(decorateTransaction)
-        wp = (yield schedulePolledGroupCachingUpdate(store))
-        yield wp.whenExecuted()
-        self.assertTrue(groupCacher.called)
+    #     store = yield buildStore(self, None)
+    #     store.callWithNewTransactions(decorateTransaction)
+    #     wp = (yield schedulePolledGroupCachingUpdate(store))
+    #     yield wp.whenExecuted()
+    #     self.assertTrue(groupCacher.called)
 
-    testScheduling.skip = "Fix WorkProposal to track delayed calls and cancel them"
+    # testScheduling.skip = "Fix WorkProposal to track delayed calls and cancel them"
 
 
 

Modified: CalendarServer/trunk/twistedcaldav/stdconfig.py
===================================================================
--- CalendarServer/trunk/twistedcaldav/stdconfig.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/twistedcaldav/stdconfig.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -735,6 +735,7 @@
             "AllowResourceAsOrganizer"            : False, # Allow resources to be Organizers
             "AllowLocationWithoutOrganizer"       : True, # Allow locations to have events without an Organizer
             "AllowResourceWithoutOrganizer"       : True, # Allow resources to have events without an Organizer
+            "AllowGroupAsAttendee"                : False, # Allow groups to be Attendees
             "TrackUnscheduledLocationData"        : True, # Track who the last modifier of an unscheduled location event is
             "TrackUnscheduledResourceData"        : True, # Track who the last modifier of an unscheduled resource event is
             "LimitFreeBusyAttendees"              : 30, # Maximum number of attendees to request freebusy for

Modified: CalendarServer/trunk/txdav/common/datastore/sql.py
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql.py	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/txdav/common/datastore/sql.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -68,7 +68,7 @@
 from txdav.common.datastore.sql_tables import schema, splitSQLString
 from txdav.common.icommondatastore import ConcurrentModification, \
     RecordNotAllowedError, ExternalShareFailed, ShareNotAllowed, \
-    IndexedSearchException
+    IndexedSearchException, NotFoundError
 from txdav.common.icommondatastore import HomeChildNameNotAllowedError, \
     HomeChildNameAlreadyExistsError, NoSuchHomeChildError, \
     ObjectResourceNameNotAllowedError, ObjectResourceNameAlreadyExistsError, \
@@ -87,6 +87,7 @@
 from zope.interface import implements, directlyProvides
 
 from collections import namedtuple
+import datetime
 import itertools
 import json
 import sys
@@ -107,6 +108,7 @@
     EADDRESSBOOKTYPE: "CardDAV",
 }
 
+
 class CommonDataStore(Service, object):
     """
     Shared logic for SQL-based data stores, between calendar and addressbook
@@ -692,8 +694,8 @@
                        apn.RESOURCE_KEY: Parameter("resourceKey"),
                        apn.MODIFIED: Parameter("modified"),
                        apn.SUBSCRIBER_GUID: Parameter("subscriber"),
-                       apn.USER_AGENT : Parameter("userAgent"),
-                       apn.IP_ADDR : Parameter("ipAddr")})
+                       apn.USER_AGENT: Parameter("userAgent"),
+                       apn.IP_ADDR: Parameter("ipAddr")})
 
 
     @classproperty
@@ -702,7 +704,7 @@
         return Update({apn.MODIFIED: Parameter("modified"),
                        apn.SUBSCRIBER_GUID: Parameter("subscriber"),
                        apn.USER_AGENT: Parameter("userAgent"),
-                       apn.IP_ADDR : Parameter("ipAddr")},
+                       apn.IP_ADDR: Parameter("ipAddr")},
                       Where=(apn.TOKEN == Parameter("token")).And(
                              apn.RESOURCE_KEY == Parameter("resourceKey")))
 
@@ -910,12 +912,683 @@
         """
         @type olderThan: datetime
         """
-        return self._purgeOldIMIPTokensQuery.on(self,
-            olderThan=olderThan)
+        return self._purgeOldIMIPTokensQuery.on(self, olderThan=olderThan)
 
     # End of IMIP
 
 
+    # Groups
+
+    @classproperty
+    def _addGroupQuery(cls):
+        gr = schema.GROUPS
+        return Insert({gr.NAME: Parameter("name"),
+                       gr.GROUP_GUID: Parameter("groupGUID"),
+                       gr.MEMBERSHIP_HASH: Parameter("membershipHash")},
+                       Return=gr.GROUP_ID)
+
+
+    @classproperty
+    def _updateGroupQuery(cls):
+        gr = schema.GROUPS
+        return Update({gr.MEMBERSHIP_HASH: Parameter("membershipHash"),
+            gr.NAME: Parameter("name"), gr.MODIFIED: Parameter("timestamp")},
+            Where=(gr.GROUP_GUID == Parameter("groupGUID")))
+
+
+    @classproperty
+    def _groupByGUID(cls):
+        gr = schema.GROUPS
+        return Select([gr.GROUP_ID, gr.NAME, gr.MEMBERSHIP_HASH], From=gr,
+                Where=(
+                    gr.GROUP_GUID == Parameter("groupGUID")
+                )
+            )
+
+
+    @classproperty
+    def _groupByID(cls):
+        gr = schema.GROUPS
+        return Select([gr.GROUP_GUID, gr.NAME, gr.MEMBERSHIP_HASH], From=gr,
+                Where=(
+                    gr.GROUP_ID == Parameter("groupID")
+                )
+            )
+
+
+    @classproperty
+    def _deleteGroup(cls):
+        gr = schema.GROUPS
+        return Delete(From=gr,
+              Where=(gr.GROUP_ID == Parameter("groupID")))
+
+
+    def addGroup(self, groupGUID, name, membershipHash):
+        """
+        @type groupGUID: C{UUID}
+        """
+        return self._addGroupQuery.on(self, name=name,
+            groupGUID=str(groupGUID), membershipHash=membershipHash)
+
+
+    def updateGroup(self, groupGUID, name, membershipHash):
+        """
+        @type groupGUID: C{UUID}
+        """
+        timestamp = datetime.datetime.utcnow()
+        return self._updateGroupQuery.on(self, name=name,
+            groupGUID=str(groupGUID), timestamp=timestamp,
+            membershipHash=membershipHash)
+
+
+    @inlineCallbacks
+    def groupByGUID(self, groupGUID):
+        """
+        @type groupGUID: C{UUID}
+        """
+        results = (yield self._groupByGUID.on(self, groupGUID=str(groupGUID)))
+        if results:
+            returnValue(results[0])
+        else:
+            savepoint = SavepointAction("groupByGUID")
+            yield savepoint.acquire(self)
+            try:
+                yield self.addGroup(groupGUID, "", "")
+            except Exception:
+                yield savepoint.rollback(self)
+                results = (yield self._groupByGUID.on(self,
+                    groupGUID=str(groupGUID)))
+                if results:
+                    returnValue(results[0])
+                else:
+                    raise
+            else:
+                yield savepoint.release(self)
+                results = (yield self._groupByGUID.on(self,
+                    groupGUID=str(groupGUID)))
+                if results:
+                    returnValue(results[0])
+                else:
+                    raise
+
+
+    @inlineCallbacks
+    def groupByID(self, groupID):
+        try:
+            results = (yield self._groupByID.on(self, groupID=groupID))[0]
+            if results:
+                results = [UUID("urn:uuid:" + results[0])] + results[1:]
+            returnValue(results)
+        except IndexError:
+            raise NotFoundError
+
+
+    def deleteGroup(self, groupID):
+        return self._deleteGroup.on(self, groupID=groupID)
+
+    # End of Groups
+
+
+    # Group Members
+
+    @classproperty
+    def _addMemberToGroupQuery(cls):
+        gm = schema.GROUP_MEMBERSHIP
+        return Insert(
+            {
+                gm.GROUP_ID: Parameter("groupID"),
+                gm.MEMBER_GUID: Parameter("memberGUID")
+            }
+        )
+
+
+    @classproperty
+    def _removeMemberFromGroupQuery(cls):
+        gm = schema.GROUP_MEMBERSHIP
+        return Delete(
+            From=gm,
+            Where=(
+                gm.GROUP_ID == Parameter("groupID")
+            ).And(
+                gm.MEMBER_GUID == Parameter("memberGUID")
+            )
+        )
+
+
+    @classproperty
+    def _selectGroupMembersQuery(cls):
+        gm = schema.GROUP_MEMBERSHIP
+        return Select(
+            [gm.MEMBER_GUID],
+            From=gm,
+            Where=(
+                gm.GROUP_ID == Parameter("groupID")
+            )
+        )
+
+
+    @classproperty
+    def _selectGroupsForQuery(cls):
+        gm = schema.GROUP_MEMBERSHIP
+        return Select(
+            [gm.GROUP_ID],
+            From=gm,
+            Where=(
+                gm.MEMBER_GUID == Parameter("guid")
+            )
+        )
+
+
+    def addMemberToGroup(self, memberGUID, groupID):
+        return self._addMemberToGroupQuery.on(
+            self, groupID=groupID, memberGUID=str(memberGUID)
+        )
+
+
+    def removeMemberFromGroup(self, memberGUID, groupID):
+        return self._removeMemberFromGroupQuery.on(
+            self, groupID=groupID, memberGUID=str(memberGUID)
+        )
+
+
+    @inlineCallbacks
+    def membersOfGroup(self, groupID):
+        """
+        Returns the cached set of GUIDs for members of the given groupID.
+        Sub-groups are not returned in the results but their members are,
+        because the group membership has already been expanded/flattened
+        before storing in the db.
+
+        @param groupID: the group ID
+        @type groupID: C{int}
+        @return: the set of member GUIDs
+        @rtype: a Deferred which fires with a set() of C{str} GUIDs
+        """
+        members = set()
+        results = (yield self._selectGroupMembersQuery.on(self, groupID=groupID))
+        for row in results:
+            members.add(UUID("urn:uuid:" + row[0]))
+        returnValue(members)
+
+
+    @inlineCallbacks
+    def groupsFor(self, guid):
+        """
+        Returns the cached set of GUIDs for the groups this given guid is
+        a member of.
+
+        @param guid: the guid
+        @type guid: C{UUID}
+        @return: the set of group IDs
+        @rtype: a Deferred which fires with a set() of C{int} group IDs
+        """
+        groups = set()
+        results = (yield self._selectGroupsForQuery.on(self, guid=str(guid)))
+        for row in results:
+            groups.add(row[0])
+        returnValue(groups)
+
+    # End of Group Members
+
+    # Delegates
+
+
+    @classproperty
+    def _addDelegateQuery(cls):
+        de = schema.DELEGATES
+        return Insert({de.DELEGATOR: Parameter("delegator"),
+                       de.DELEGATE: Parameter("delegate"),
+                       de.READ_WRITE: Parameter("readWrite"),
+                       })
+
+
+    @classproperty
+    def _addDelegateGroupQuery(cls):
+        ds = schema.DELEGATE_GROUPS
+        return Insert({ds.DELEGATOR: Parameter("delegator"),
+                       ds.GROUP_ID: Parameter("groupID"),
+                       ds.READ_WRITE: Parameter("readWrite"),
+                       ds.IS_EXTERNAL: Parameter("isExternal"),
+                       })
+
+
+    @classproperty
+    def _removeDelegateQuery(cls):
+        de = schema.DELEGATES
+        return Delete(
+            From=de,
+            Where=(
+                de.DELEGATOR == Parameter("delegator")
+            ).And(
+                de.DELEGATE == Parameter("delegate")
+            ).And(
+                de.READ_WRITE == Parameter("readWrite")
+            )
+        )
+
+
+    @classproperty
+    def _removeDelegateGroupQuery(cls):
+        ds = schema.DELEGATE_GROUPS
+        return Delete(
+            From=ds,
+            Where=(
+                ds.DELEGATOR == Parameter("delegator")
+            ).And(
+                ds.GROUP_ID == Parameter("groupID")
+            ).And(
+                ds.READ_WRITE == Parameter("readWrite")
+            )
+        )
+
+
+    @classproperty
+    def _selectDelegatesQuery(cls):
+        de = schema.DELEGATES
+        return Select(
+            [de.DELEGATE],
+            From=de,
+            Where=(
+                de.DELEGATOR == Parameter("delegator")
+            ).And(
+                de.READ_WRITE == Parameter("readWrite")
+            )
+        )
+
+
+    @classproperty
+    def _selectDelegateGroupsQuery(cls):
+        ds = schema.DELEGATE_GROUPS
+        return Select(
+            [ds.GROUP_ID],
+            From=ds,
+            Where=(
+                ds.DELEGATOR == Parameter("delegator")
+            ).And(
+                ds.READ_WRITE == Parameter("readWrite")
+            )
+        )
+
+
+    @classproperty
+    def _selectDirectDelegatorsQuery(cls):
+        de = schema.DELEGATES
+        return Select(
+            [de.DELEGATOR],
+            From=de,
+            Where=(
+                de.DELEGATE == Parameter("delegate")
+            ).And(
+                de.READ_WRITE == Parameter("readWrite")
+            )
+        )
+
+
+    @classproperty
+    def _selectIndirectDelegatorsQuery(cls):
+        dg = schema.DELEGATE_GROUPS
+        gm = schema.GROUP_MEMBERSHIP
+
+        return Select(
+            [dg.DELEGATOR],
+            From=dg,
+            Where=(
+                dg.GROUP_ID.In(
+                    Select(
+                        [gm.GROUP_ID],
+                        From=gm,
+                        Where=(gm.MEMBER_GUID == Parameter("delegate"))
+                    )
+                ).And(
+                    dg.READ_WRITE == Parameter("readWrite")
+                )
+            )
+        )
+
+
+    @classproperty
+    def _selectIndirectDelegatesQuery(cls):
+        dg = schema.DELEGATE_GROUPS
+        gm = schema.GROUP_MEMBERSHIP
+
+        return Select(
+            [gm.MEMBER_GUID],
+            From=gm,
+            Where=(
+                gm.GROUP_ID.In(
+                    Select(
+                        [dg.GROUP_ID],
+                        From=dg,
+                        Where=(dg.DELEGATOR == Parameter("delegator")).And(
+                            dg.READ_WRITE == Parameter("readWrite"))
+                    )
+                )
+            )
+        )
+
+
+    @classproperty
+    def _selectExternalDelegateGroupsQuery(cls):
+        edg = schema.EXTERNAL_DELEGATE_GROUPS
+        return Select(
+            [edg.DELEGATOR, edg.GROUP_GUID_READ, edg.GROUP_GUID_WRITE],
+            From=edg
+        )
+
+
+    @classproperty
+    def _removeExternalDelegateGroupsPairQuery(cls):
+        edg = schema.EXTERNAL_DELEGATE_GROUPS
+        return Delete(
+            From=edg,
+            Where=(
+                edg.DELEGATOR == Parameter("delegator")
+            )
+        )
+
+
+    @classproperty
+    def _storeExternalDelegateGroupsPairQuery(cls):
+        edg = schema.EXTERNAL_DELEGATE_GROUPS
+        return Insert(
+            {
+                edg.DELEGATOR: Parameter("delegator"),
+                edg.GROUP_GUID_READ: Parameter("readDelegate"),
+                edg.GROUP_GUID_WRITE: Parameter("writeDelegate"),
+            }
+        )
+
+
+    @classproperty
+    def _removeExternalDelegateGroupsQuery(cls):
+        ds = schema.DELEGATE_GROUPS
+        return Delete(
+            From=ds,
+            Where=(
+                ds.DELEGATOR == Parameter("delegator")
+            ).And(
+                ds.IS_EXTERNAL == 1
+            )
+        )
+
+
+    def addDelegate(self, delegator, delegate, readWrite):
+        """
+        Adds a row to the DELEGATES table.  The delegate should not be a
+        group.  To delegate to a group, call addDelegateGroup() instead.
+
+        @param delegator: the GUID of the delegator
+        @type delegator: C{UUID}
+        @param delegate: the GUID of the delegate
+        @type delegate: C{UUID}
+        @param readWrite: grant read and write access if True, otherwise
+            read-only access
+        @type readWrite: C{boolean}
+        """
+        return self._addDelegateQuery.on(
+            self,
+            delegator=str(delegator),
+            delegate=str(delegate),
+            readWrite=1 if readWrite else 0
+        )
+
+
+    def addDelegateGroup(self, delegator, delegateGroupID, readWrite,
+                         isExternal=False):
+        """
+        Adds a row to the DELEGATE_GROUPS table.  The delegate should be a
+        group.  To delegate to a person, call addDelegate() instead.
+
+        @param delegator: the GUID of the delegator
+        @type delegator: C{UUID}
+        @param delegateGroupID: the GROUP_ID of the delegate group
+        @type delegateGroupID: C{int}
+        @param readWrite: grant read and write access if True, otherwise
+            read-only access
+        @type readWrite: C{boolean}
+        """
+        return self._addDelegateGroupQuery.on(
+            self,
+            delegator=str(delegator),
+            groupID=delegateGroupID,
+            readWrite=1 if readWrite else 0,
+            isExternal=1 if isExternal else 0
+        )
+
+
+    def removeDelegate(self, delegator, delegate, readWrite):
+        """
+        Removes a row from the DELEGATES table.  The delegate should not be a
+        group.  To remove a delegate group, call removeDelegateGroup() instead.
+
+        @param delegator: the GUID of the delegator
+        @type delegator: C{UUID}
+        @param delegate: the GUID of the delegate
+        @type delegate: C{UUID}
+        @param readWrite: remove read and write access if True, otherwise
+            read-only access
+        @type readWrite: C{boolean}
+        """
+        return self._removeDelegateQuery.on(
+            self,
+            delegator=str(delegator),
+            delegate=str(delegate),
+            readWrite=1 if readWrite else 0
+        )
+
+
+    def removeDelegateGroup(self, delegator, delegateGroupID, readWrite):
+        """
+        Removes a row from the DELEGATE_GROUPS table.  The delegate should be a
+        group.  To remove a delegate person, call removeDelegate() instead.
+
+        @param delegator: the GUID of the delegator
+        @type delegator: C{UUID}
+        @param delegateGroupID: the GROUP_ID of the delegate group
+        @type delegateGroupID: C{int}
+        @param readWrite: remove read and write access if True, otherwise
+            read-only access
+        @type readWrite: C{boolean}
+        """
+        return self._removeDelegateGroupQuery.on(
+            self,
+            delegator=str(delegator),
+            groupID=delegateGroupID,
+            readWrite=1 if readWrite else 0
+        )
+
+
+    @inlineCallbacks
+    def delegates(self, delegator, readWrite):
+        """
+        Returns the GUIDs of all delegates for the given delegator.  If
+        delegate access was granted to any groups, those groups' members
+        (flattened) will be included. No GUIDs of the groups themselves
+        will be returned.
+
+        @param delegator: the GUID of the delegator
+        @type delegator: C{UUID}
+        @param readWrite: the access-type to check for; read and write
+            access if True, otherwise read-only access
+        @type readWrite: C{boolean}
+        @returns: the GUIDs of the delegates (for the specified access
+            type)
+        @rtype: a Deferred resulting in a set
+        """
+        delegates = set()
+
+
+        # First get the direct delegates
+        results = (
+            yield self._selectDelegatesQuery.on(
+                self,
+                delegator=str(delegator),
+                readWrite=1 if readWrite else 0
+            )
+        )
+        for row in results:
+            delegates.add(UUID("urn:uuid:" + row[0]))
+
+        # Finally get those who are in groups which have been delegated to
+        results = (
+            yield self._selectIndirectDelegatesQuery.on(
+                self,
+                delegator=str(delegator),
+                readWrite=1 if readWrite else 0
+            )
+        )
+        for row in results:
+            delegates.add(UUID("urn:uuid:" + row[0]))
+
+        returnValue(delegates)
+
+
+    @inlineCallbacks
+    def delegators(self, delegate, readWrite):
+        """
+        Returns the GUIDs of all delegators which have granted access to
+        the given delegate, either directly or indirectly via groups.
+
+        @param delegate: the GUID of the delegate
+        @type delegate: C{UUID}
+        @param readWrite: the access-type to check for; read and write
+            access if True, otherwise read-only access
+        @type readWrite: C{boolean}
+        @returns: the GUIDs of the delegators (for the specified access
+            type)
+        @rtype: a Deferred resulting in a set
+        """
+        delegators = set()
+
+        # First get the direct delegators
+        results = (
+            yield self._selectDirectDelegatorsQuery.on(
+                self,
+                delegate=str(delegate),
+                readWrite=1 if readWrite else 0
+            )
+        )
+        for row in results:
+            delegators.add(UUID("urn:uuid:" + row[0]))
+
+        # Finally get those who have delegated to groups the delegate
+        # is a member of
+        results = (
+            yield self._selectIndirectDelegatorsQuery.on(
+                self,
+                delegate=str(delegate),
+                readWrite=1 if readWrite else 0
+            )
+        )
+        for row in results:
+            delegators.add(UUID("urn:uuid:" + row[0]))
+
+        returnValue(delegators)
+
+
+    @inlineCallbacks
+    def allGroupDelegates(self):
+        """
+        Return the GUIDs of all groups which have been delegated to.  Useful
+        for obtaining the set of groups which need to be synchronized from
+        the directory.
+
+        @returns: the GUIDs of all delegated-to groups
+        @rtype: a Deferred resulting in a set
+        """
+        gr = schema.GROUPS
+        dg = schema.DELEGATE_GROUPS
+
+        results = (yield Select(
+            [gr.GROUP_GUID],
+            From=gr,
+            Where=(gr.GROUP_ID.In(Select([dg.GROUP_ID], From=dg, Where=None)))
+        ).on(self))
+        delegates = set()
+        for row in results:
+            delegates.add(UUID("urn:uuid:" + row[0]))
+
+        returnValue(delegates)
+
+
+    @inlineCallbacks
+    def externalDelegates(self):
+        """
+        Returns a dictionary mapping delegate GUIDs to (read-group, write-group)
+        tuples, including only those assignments that originated from the
+        directory.
+
+        @returns: dictionary mapping delegator guid to (readDelegateGUID,
+            writeDelegateGUID) tuples
+        @rtype: a Deferred resulting in a dictionary
+        """
+        delegates = {}
+
+        # Get the externally managed delegates (which are all groups)
+        results = (yield self._selectExternalDelegateGroupsQuery.on(self))
+        for delegator, readDelegateGUID, writeDelegateGUID in results:
+            delegates[UUID(delegator)] = (
+                UUID(readDelegateGUID) if readDelegateGUID else None,
+                UUID(writeDelegateGUID) if writeDelegateGUID else None
+            )
+
+        returnValue(delegates)
+
+
+    @inlineCallbacks
+    def assignExternalDelegates(
+        self, delegator, readDelegateGroupID, writeDelegateGroupID,
+        readDelegateGUID, writeDelegateGUID
+    ):
+        """
+        Update the external delegate group table so we can quickly identify
+        diffs next time, and update the delegate group table itself
+
+        @param delegator
+        @type delegator: C{UUID}
+        """
+
+        # Delete existing external assignments for the delegator
+        yield self._removeExternalDelegateGroupsQuery.on(
+            self,
+            delegator=str(delegator)
+        )
+
+        # Remove from the external comparison table
+        yield self._removeExternalDelegateGroupsPairQuery.on(
+            self,
+            delegator=str(delegator)
+        )
+
+        # Store new assignments in the external comparison table
+        if readDelegateGUID or writeDelegateGUID:
+            readDelegateForDB = (
+                str(readDelegateGUID) if readDelegateGUID else ""
+            )
+            writeDelegateForDB = (
+                str(writeDelegateGUID) if writeDelegateGUID else ""
+            )
+            yield self._storeExternalDelegateGroupsPairQuery.on(
+                self,
+                delegator=str(delegator),
+                readDelegate=readDelegateForDB,
+                writeDelegate=writeDelegateForDB
+            )
+
+        # Apply new assignments
+        if readDelegateGroupID is not None:
+            yield self.addDelegateGroup(
+                delegator, readDelegateGroupID, False, isExternal=True
+            )
+        if writeDelegateGroupID is not None:
+            yield self.addDelegateGroup(
+                delegator, writeDelegateGroupID, True, isExternal=True
+            )
+
+
+    # End of Delegates
+
+
     def preCommit(self, operation):
         """
         Run things before C{commit}.  (Note: only provided by SQL

Modified: CalendarServer/trunk/txdav/common/datastore/sql_schema/current-oracle-dialect.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/current-oracle-dialect.sql	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/current-oracle-dialect.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -379,6 +379,59 @@
     "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
 );
 
+create table GROUP_REFRESH_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "GROUP_GUID" nvarchar2(255)
+);
+
+create table GROUP_ATTENDEE_RECONCILIATION_ (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "RESOURCE_ID" integer,
+    "GROUP_ID" integer
+);
+
+create table GROUPS (
+    "GROUP_ID" integer primary key,
+    "NAME" nvarchar2(255),
+    "GROUP_GUID" nvarchar2(255),
+    "MEMBERSHIP_HASH" nvarchar2(255),
+    "EXTANT" integer default 1,
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table GROUP_MEMBERSHIP (
+    "GROUP_ID" integer,
+    "MEMBER_GUID" nvarchar2(255)
+);
+
+create table GROUP_ATTENDEE (
+    "GROUP_ID" integer,
+    "RESOURCE_ID" integer,
+    "MEMBERSHIP_HASH" nvarchar2(255)
+);
+
+create table DELEGATES (
+    "DELEGATOR" nvarchar2(255),
+    "DELEGATE" nvarchar2(255),
+    "READ_WRITE" integer not null
+);
+
+create table DELEGATE_GROUPS (
+    "DELEGATOR" nvarchar2(255),
+    "GROUP_ID" integer not null,
+    "READ_WRITE" integer not null,
+    "IS_EXTERNAL" integer not null
+);
+
+create table EXTERNAL_DELEGATE_GROUPS (
+    "DELEGATOR" nvarchar2(255),
+    "GROUP_GUID_READ" nvarchar2(255),
+    "GROUP_GUID_WRITE" nvarchar2(255)
+);
+
 create table CALENDAR_OBJECT_SPLITTER_WORK (
     "WORK_ID" integer primary key not null,
     "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
@@ -462,7 +515,7 @@
     "VALUE" nvarchar2(255)
 );
 
-insert into CALENDARSERVER (NAME, VALUE) values ('VERSION', '34');
+insert into CALENDARSERVER (NAME, VALUE) values ('VERSION', '35');
 insert into CALENDARSERVER (NAME, VALUE) values ('CALENDAR-DATAVERSION', '5');
 insert into CALENDARSERVER (NAME, VALUE) values ('ADDRESSBOOK-DATAVERSION', '2');
 insert into CALENDARSERVER (NAME, VALUE) values ('NOTIFICATION-DATAVERSION', '1');
@@ -596,6 +649,18 @@
     TOKEN
 );
 
+create index GROUPS_GROUP_GUID_ebf7a1d4 on GROUPS (
+    GROUP_GUID
+);
+
+create index GROUP_MEMBERSHIP_GROU_9560a5e6 on GROUP_MEMBERSHIP (
+    GROUP_ID
+);
+
+create index GROUP_MEMBERSHIP_MEMB_0ca508e8 on GROUP_MEMBERSHIP (
+    MEMBER_GUID
+);
+
 create index CALENDAR_OBJECT_SPLIT_af71dcda on CALENDAR_OBJECT_SPLITTER_WORK (
     RESOURCE_ID
 );

Modified: CalendarServer/trunk/txdav/common/datastore/sql_schema/current.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/current.sql	2014-02-12 00:26:02 UTC (rev 12662)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/current.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -522,7 +522,7 @@
 
 -- Joins ADDRESSBOOK_HOME and ADDRESSBOOK_OBJECT (kind == group)
 
-create table SHARED_GROUP_BIND (	
+create table SHARED_GROUP_BIND (
   ADDRESSBOOK_HOME_RESOURCE_ID 		integer      not null references ADDRESSBOOK_HOME,
   GROUP_RESOURCE_ID      			integer      not null references ADDRESSBOOK_OBJECT on delete cascade,
   EXTERNAL_ID			            integer      default null,
@@ -632,7 +632,7 @@
 create index APN_SUBSCRIPTIONS_RESOURCE_KEY
    on APN_SUBSCRIPTIONS(RESOURCE_KEY);
 
-   
+
 -----------------
 -- IMIP Tokens --
 -----------------
@@ -650,7 +650,7 @@
 create index IMIP_TOKENS_TOKEN
    on IMIP_TOKENS(TOKEN);
 
-   
+
 ----------------
 -- Work Items --
 ----------------
@@ -714,7 +714,67 @@
   NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
 );
 
+create table GROUP_REFRESH_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  GROUP_GUID                    varchar(255) not null
+);
 
+create table GROUP_ATTENDEE_RECONCILIATION_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  RESOURCE_ID                   integer,
+  GROUP_ID                      integer
+);
+
+
+create table GROUPS (
+  GROUP_ID                      integer      primary key default nextval('RESOURCE_ID_SEQ'),    -- implicit index
+  NAME                          varchar(255) not null,
+  GROUP_GUID                    varchar(255) not null,
+  MEMBERSHIP_HASH               varchar(255) not null,
+  EXTANT                        integer default 1,
+  CREATED                       timestamp default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                      timestamp default timezone('UTC', CURRENT_TIMESTAMP)
+);
+create index GROUPS_GROUP_GUID on GROUPS(GROUP_GUID);
+
+create table GROUP_MEMBERSHIP (
+  GROUP_ID                      integer,
+  MEMBER_GUID                   varchar(255) not null
+);
+create index GROUP_MEMBERSHIP_GROUP on GROUP_MEMBERSHIP(GROUP_ID);
+create index GROUP_MEMBERSHIP_MEMBER on GROUP_MEMBERSHIP(MEMBER_GUID);
+
+create table GROUP_ATTENDEE (
+  GROUP_ID                      integer,
+  RESOURCE_ID                   integer,
+  MEMBERSHIP_HASH               varchar(255) not null
+);
+
+---------------
+-- Delegates --
+---------------
+
+create table DELEGATES (
+  DELEGATOR                     varchar(255) not null,
+  DELEGATE                      varchar(255) not null,
+  READ_WRITE                    integer      not null -- 1 = ReadWrite, 0 = ReadOnly
+);
+
+create table DELEGATE_GROUPS (
+  DELEGATOR                     varchar(255) not null,
+  GROUP_ID                      integer      not null,
+  READ_WRITE                    integer      not null, -- 1 = ReadWrite, 0 = ReadOnly
+  IS_EXTERNAL                   integer      not null -- 1 = ReadWrite, 0 = ReadOnly
+);
+
+create table EXTERNAL_DELEGATE_GROUPS (
+  DELEGATOR                     varchar(255) not null,
+  GROUP_GUID_READ               varchar(255),
+  GROUP_GUID_WRITE              varchar(255)
+);
+
 --------------------------
 -- Object Splitter Work --
 --------------------------
@@ -862,7 +922,7 @@
   VALUE                         varchar(255)
 );
 
-insert into CALENDARSERVER values ('VERSION', '34');
+insert into CALENDARSERVER values ('VERSION', '35');
 insert into CALENDARSERVER values ('CALENDAR-DATAVERSION', '5');
 insert into CALENDARSERVER values ('ADDRESSBOOK-DATAVERSION', '2');
 insert into CALENDARSERVER values ('NOTIFICATION-DATAVERSION', '1');

Added: CalendarServer/trunk/txdav/common/datastore/sql_schema/old/oracle-dialect/v34.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/old/oracle-dialect/v34.sql	                        (rev 0)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/old/oracle-dialect/v34.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,643 @@
+create sequence RESOURCE_ID_SEQ;
+create sequence INSTANCE_ID_SEQ;
+create sequence ATTACHMENT_ID_SEQ;
+create sequence REVISION_SEQ;
+create sequence WORKITEM_SEQ;
+create table NODE_INFO (
+    "HOSTNAME" nvarchar2(255),
+    "PID" integer not null,
+    "PORT" integer not null,
+    "TIME" timestamp default CURRENT_TIMESTAMP at time zone 'UTC' not null, 
+    primary key("HOSTNAME", "PORT")
+);
+
+create table NAMED_LOCK (
+    "LOCK_NAME" nvarchar2(255) primary key
+);
+
+create table CALENDAR_HOME (
+    "RESOURCE_ID" integer primary key,
+    "OWNER_UID" nvarchar2(255) unique,
+    "STATUS" integer default 0 not null,
+    "DATAVERSION" integer default 0 not null
+);
+
+create table HOME_STATUS (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into HOME_STATUS (DESCRIPTION, ID) values ('normal', 0);
+insert into HOME_STATUS (DESCRIPTION, ID) values ('external', 1);
+create table CALENDAR (
+    "RESOURCE_ID" integer primary key
+);
+
+create table CALENDAR_HOME_METADATA (
+    "RESOURCE_ID" integer primary key references CALENDAR_HOME on delete cascade,
+    "QUOTA_USED_BYTES" integer default 0 not null,
+    "DEFAULT_EVENTS" integer default null references CALENDAR on delete set null,
+    "DEFAULT_TASKS" integer default null references CALENDAR on delete set null,
+    "DEFAULT_POLLS" integer default null references CALENDAR on delete set null,
+    "ALARM_VEVENT_TIMED" nclob default null,
+    "ALARM_VEVENT_ALLDAY" nclob default null,
+    "ALARM_VTODO_TIMED" nclob default null,
+    "ALARM_VTODO_ALLDAY" nclob default null,
+    "AVAILABILITY" nclob default null,
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table CALENDAR_METADATA (
+    "RESOURCE_ID" integer primary key references CALENDAR on delete cascade,
+    "SUPPORTED_COMPONENTS" nvarchar2(255) default null,
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table NOTIFICATION_HOME (
+    "RESOURCE_ID" integer primary key,
+    "OWNER_UID" nvarchar2(255) unique,
+    "STATUS" integer default 0 not null,
+    "DATAVERSION" integer default 0 not null
+);
+
+create table NOTIFICATION (
+    "RESOURCE_ID" integer primary key,
+    "NOTIFICATION_HOME_RESOURCE_ID" integer not null references NOTIFICATION_HOME,
+    "NOTIFICATION_UID" nvarchar2(255),
+    "NOTIFICATION_TYPE" nvarchar2(255),
+    "NOTIFICATION_DATA" nclob,
+    "MD5" nchar(32),
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    unique("NOTIFICATION_UID", "NOTIFICATION_HOME_RESOURCE_ID")
+);
+
+create table CALENDAR_BIND (
+    "CALENDAR_HOME_RESOURCE_ID" integer not null references CALENDAR_HOME,
+    "CALENDAR_RESOURCE_ID" integer not null references CALENDAR on delete cascade,
+    "EXTERNAL_ID" integer default null,
+    "CALENDAR_RESOURCE_NAME" nvarchar2(255),
+    "BIND_MODE" integer not null,
+    "BIND_STATUS" integer not null,
+    "BIND_REVISION" integer default 0 not null,
+    "MESSAGE" nclob,
+    "TRANSP" integer default 0 not null,
+    "ALARM_VEVENT_TIMED" nclob default null,
+    "ALARM_VEVENT_ALLDAY" nclob default null,
+    "ALARM_VTODO_TIMED" nclob default null,
+    "ALARM_VTODO_ALLDAY" nclob default null,
+    "TIMEZONE" nclob default null, 
+    primary key("CALENDAR_HOME_RESOURCE_ID", "CALENDAR_RESOURCE_ID"), 
+    unique("CALENDAR_HOME_RESOURCE_ID", "CALENDAR_RESOURCE_NAME")
+);
+
+create table CALENDAR_BIND_MODE (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into CALENDAR_BIND_MODE (DESCRIPTION, ID) values ('own', 0);
+insert into CALENDAR_BIND_MODE (DESCRIPTION, ID) values ('read', 1);
+insert into CALENDAR_BIND_MODE (DESCRIPTION, ID) values ('write', 2);
+insert into CALENDAR_BIND_MODE (DESCRIPTION, ID) values ('direct', 3);
+insert into CALENDAR_BIND_MODE (DESCRIPTION, ID) values ('indirect', 4);
+create table CALENDAR_BIND_STATUS (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into CALENDAR_BIND_STATUS (DESCRIPTION, ID) values ('invited', 0);
+insert into CALENDAR_BIND_STATUS (DESCRIPTION, ID) values ('accepted', 1);
+insert into CALENDAR_BIND_STATUS (DESCRIPTION, ID) values ('declined', 2);
+insert into CALENDAR_BIND_STATUS (DESCRIPTION, ID) values ('invalid', 3);
+insert into CALENDAR_BIND_STATUS (DESCRIPTION, ID) values ('deleted', 4);
+create table CALENDAR_TRANSP (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into CALENDAR_TRANSP (DESCRIPTION, ID) values ('opaque', 0);
+insert into CALENDAR_TRANSP (DESCRIPTION, ID) values ('transparent', 1);
+create table CALENDAR_OBJECT (
+    "RESOURCE_ID" integer primary key,
+    "CALENDAR_RESOURCE_ID" integer not null references CALENDAR on delete cascade,
+    "RESOURCE_NAME" nvarchar2(255),
+    "ICALENDAR_TEXT" nclob,
+    "ICALENDAR_UID" nvarchar2(255),
+    "ICALENDAR_TYPE" nvarchar2(255),
+    "ATTACHMENTS_MODE" integer default 0 not null,
+    "DROPBOX_ID" nvarchar2(255),
+    "ORGANIZER" nvarchar2(255),
+    "RECURRANCE_MIN" date,
+    "RECURRANCE_MAX" date,
+    "ACCESS" integer default 0 not null,
+    "SCHEDULE_OBJECT" integer default 0,
+    "SCHEDULE_TAG" nvarchar2(36) default null,
+    "SCHEDULE_ETAGS" nclob default null,
+    "PRIVATE_COMMENTS" integer default 0 not null,
+    "MD5" nchar(32),
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    unique("CALENDAR_RESOURCE_ID", "RESOURCE_NAME")
+);
+
+create table CALENDAR_OBJECT_ATTACHMENTS_MO (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into CALENDAR_OBJECT_ATTACHMENTS_MO (DESCRIPTION, ID) values ('none', 0);
+insert into CALENDAR_OBJECT_ATTACHMENTS_MO (DESCRIPTION, ID) values ('read', 1);
+insert into CALENDAR_OBJECT_ATTACHMENTS_MO (DESCRIPTION, ID) values ('write', 2);
+create table CALENDAR_ACCESS_TYPE (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(32) unique
+);
+
+insert into CALENDAR_ACCESS_TYPE (DESCRIPTION, ID) values ('', 0);
+insert into CALENDAR_ACCESS_TYPE (DESCRIPTION, ID) values ('public', 1);
+insert into CALENDAR_ACCESS_TYPE (DESCRIPTION, ID) values ('private', 2);
+insert into CALENDAR_ACCESS_TYPE (DESCRIPTION, ID) values ('confidential', 3);
+insert into CALENDAR_ACCESS_TYPE (DESCRIPTION, ID) values ('restricted', 4);
+create table TIME_RANGE (
+    "INSTANCE_ID" integer primary key,
+    "CALENDAR_RESOURCE_ID" integer not null references CALENDAR on delete cascade,
+    "CALENDAR_OBJECT_RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade,
+    "FLOATING" integer not null,
+    "START_DATE" timestamp not null,
+    "END_DATE" timestamp not null,
+    "FBTYPE" integer not null,
+    "TRANSPARENT" integer not null
+);
+
+create table FREE_BUSY_TYPE (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into FREE_BUSY_TYPE (DESCRIPTION, ID) values ('unknown', 0);
+insert into FREE_BUSY_TYPE (DESCRIPTION, ID) values ('free', 1);
+insert into FREE_BUSY_TYPE (DESCRIPTION, ID) values ('busy', 2);
+insert into FREE_BUSY_TYPE (DESCRIPTION, ID) values ('busy-unavailable', 3);
+insert into FREE_BUSY_TYPE (DESCRIPTION, ID) values ('busy-tentative', 4);
+create table TRANSPARENCY (
+    "TIME_RANGE_INSTANCE_ID" integer not null references TIME_RANGE on delete cascade,
+    "USER_ID" nvarchar2(255),
+    "TRANSPARENT" integer not null
+);
+
+create table ATTACHMENT (
+    "ATTACHMENT_ID" integer primary key,
+    "CALENDAR_HOME_RESOURCE_ID" integer not null references CALENDAR_HOME,
+    "DROPBOX_ID" nvarchar2(255),
+    "CONTENT_TYPE" nvarchar2(255),
+    "SIZE" integer not null,
+    "MD5" nchar(32),
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "PATH" nvarchar2(1024)
+);
+
+create table ATTACHMENT_CALENDAR_OBJECT (
+    "ATTACHMENT_ID" integer not null references ATTACHMENT on delete cascade,
+    "MANAGED_ID" nvarchar2(255),
+    "CALENDAR_OBJECT_RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade, 
+    primary key("ATTACHMENT_ID", "CALENDAR_OBJECT_RESOURCE_ID"), 
+    unique("MANAGED_ID", "CALENDAR_OBJECT_RESOURCE_ID")
+);
+
+create table RESOURCE_PROPERTY (
+    "RESOURCE_ID" integer not null,
+    "NAME" nvarchar2(255),
+    "VALUE" nclob,
+    "VIEWER_UID" nvarchar2(255), 
+    primary key("RESOURCE_ID", "NAME", "VIEWER_UID")
+);
+
+create table ADDRESSBOOK_HOME (
+    "RESOURCE_ID" integer primary key,
+    "ADDRESSBOOK_PROPERTY_STORE_ID" integer not null,
+    "OWNER_UID" nvarchar2(255) unique,
+    "STATUS" integer default 0 not null,
+    "DATAVERSION" integer default 0 not null
+);
+
+create table ADDRESSBOOK_HOME_METADATA (
+    "RESOURCE_ID" integer primary key references ADDRESSBOOK_HOME on delete cascade,
+    "QUOTA_USED_BYTES" integer default 0 not null,
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table SHARED_ADDRESSBOOK_BIND (
+    "ADDRESSBOOK_HOME_RESOURCE_ID" integer not null references ADDRESSBOOK_HOME,
+    "OWNER_HOME_RESOURCE_ID" integer not null references ADDRESSBOOK_HOME on delete cascade,
+    "EXTERNAL_ID" integer default null,
+    "ADDRESSBOOK_RESOURCE_NAME" nvarchar2(255),
+    "BIND_MODE" integer not null,
+    "BIND_STATUS" integer not null,
+    "BIND_REVISION" integer default 0 not null,
+    "MESSAGE" nclob, 
+    primary key("ADDRESSBOOK_HOME_RESOURCE_ID", "OWNER_HOME_RESOURCE_ID"), 
+    unique("ADDRESSBOOK_HOME_RESOURCE_ID", "ADDRESSBOOK_RESOURCE_NAME")
+);
+
+create table ADDRESSBOOK_OBJECT (
+    "RESOURCE_ID" integer primary key,
+    "ADDRESSBOOK_HOME_RESOURCE_ID" integer not null references ADDRESSBOOK_HOME on delete cascade,
+    "RESOURCE_NAME" nvarchar2(255),
+    "VCARD_TEXT" nclob,
+    "VCARD_UID" nvarchar2(255),
+    "KIND" integer not null,
+    "MD5" nchar(32),
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    unique("ADDRESSBOOK_HOME_RESOURCE_ID", "RESOURCE_NAME"), 
+    unique("ADDRESSBOOK_HOME_RESOURCE_ID", "VCARD_UID")
+);
+
+create table ADDRESSBOOK_OBJECT_KIND (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into ADDRESSBOOK_OBJECT_KIND (DESCRIPTION, ID) values ('person', 0);
+insert into ADDRESSBOOK_OBJECT_KIND (DESCRIPTION, ID) values ('group', 1);
+insert into ADDRESSBOOK_OBJECT_KIND (DESCRIPTION, ID) values ('resource', 2);
+insert into ADDRESSBOOK_OBJECT_KIND (DESCRIPTION, ID) values ('location', 3);
+create table ABO_MEMBERS (
+    "GROUP_ID" integer not null,
+    "ADDRESSBOOK_ID" integer not null references ADDRESSBOOK_HOME on delete cascade,
+    "MEMBER_ID" integer not null,
+    "REVISION" integer not null,
+    "REMOVED" integer default 0 not null,
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    primary key("GROUP_ID", "MEMBER_ID", "REVISION")
+);
+
+create table ABO_FOREIGN_MEMBERS (
+    "GROUP_ID" integer not null references ADDRESSBOOK_OBJECT on delete cascade,
+    "ADDRESSBOOK_ID" integer not null references ADDRESSBOOK_HOME on delete cascade,
+    "MEMBER_ADDRESS" nvarchar2(255), 
+    primary key("GROUP_ID", "MEMBER_ADDRESS")
+);
+
+create table SHARED_GROUP_BIND (
+    "ADDRESSBOOK_HOME_RESOURCE_ID" integer not null references ADDRESSBOOK_HOME,
+    "GROUP_RESOURCE_ID" integer not null references ADDRESSBOOK_OBJECT on delete cascade,
+    "EXTERNAL_ID" integer default null,
+    "GROUP_ADDRESSBOOK_NAME" nvarchar2(255),
+    "BIND_MODE" integer not null,
+    "BIND_STATUS" integer not null,
+    "BIND_REVISION" integer default 0 not null,
+    "MESSAGE" nclob, 
+    primary key("ADDRESSBOOK_HOME_RESOURCE_ID", "GROUP_RESOURCE_ID"), 
+    unique("ADDRESSBOOK_HOME_RESOURCE_ID", "GROUP_ADDRESSBOOK_NAME")
+);
+
+create table CALENDAR_OBJECT_REVISIONS (
+    "CALENDAR_HOME_RESOURCE_ID" integer not null references CALENDAR_HOME,
+    "CALENDAR_RESOURCE_ID" integer references CALENDAR,
+    "CALENDAR_NAME" nvarchar2(255) default null,
+    "RESOURCE_NAME" nvarchar2(255),
+    "REVISION" integer not null,
+    "DELETED" integer not null,
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table ADDRESSBOOK_OBJECT_REVISIONS (
+    "ADDRESSBOOK_HOME_RESOURCE_ID" integer not null references ADDRESSBOOK_HOME,
+    "OWNER_HOME_RESOURCE_ID" integer references ADDRESSBOOK_HOME,
+    "ADDRESSBOOK_NAME" nvarchar2(255) default null,
+    "OBJECT_RESOURCE_ID" integer default 0,
+    "RESOURCE_NAME" nvarchar2(255),
+    "REVISION" integer not null,
+    "DELETED" integer not null,
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table NOTIFICATION_OBJECT_REVISIONS (
+    "NOTIFICATION_HOME_RESOURCE_ID" integer not null references NOTIFICATION_HOME on delete cascade,
+    "RESOURCE_NAME" nvarchar2(255),
+    "REVISION" integer not null,
+    "DELETED" integer not null,
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    unique("NOTIFICATION_HOME_RESOURCE_ID", "RESOURCE_NAME")
+);
+
+create table APN_SUBSCRIPTIONS (
+    "TOKEN" nvarchar2(255),
+    "RESOURCE_KEY" nvarchar2(255),
+    "MODIFIED" integer not null,
+    "SUBSCRIBER_GUID" nvarchar2(255),
+    "USER_AGENT" nvarchar2(255) default null,
+    "IP_ADDR" nvarchar2(255) default null, 
+    primary key("TOKEN", "RESOURCE_KEY")
+);
+
+create table IMIP_TOKENS (
+    "TOKEN" nvarchar2(255),
+    "ORGANIZER" nvarchar2(255),
+    "ATTENDEE" nvarchar2(255),
+    "ICALUID" nvarchar2(255),
+    "ACCESSED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC', 
+    primary key("ORGANIZER", "ATTENDEE", "ICALUID")
+);
+
+create table IMIP_INVITATION_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "FROM_ADDR" nvarchar2(255),
+    "TO_ADDR" nvarchar2(255),
+    "ICALENDAR_TEXT" nclob
+);
+
+create table IMIP_POLLING_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table IMIP_REPLY_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ORGANIZER" nvarchar2(255),
+    "ATTENDEE" nvarchar2(255),
+    "ICALENDAR_TEXT" nclob
+);
+
+create table PUSH_NOTIFICATION_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "PUSH_ID" nvarchar2(255),
+    "PRIORITY" integer not null
+);
+
+create table GROUP_CACHER_POLLING_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table CALENDAR_OBJECT_SPLITTER_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade
+);
+
+create table FIND_MIN_VALID_REVISION_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table REVISION_CLEANUP_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table SCHEDULE_REFRESH_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ICALENDAR_UID" nvarchar2(255),
+    "HOME_RESOURCE_ID" integer not null references CALENDAR_HOME on delete cascade,
+    "RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade,
+    "ATTENDEE_COUNT" integer
+);
+
+create table SCHEDULE_REFRESH_ATTENDEES (
+    "RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade,
+    "ATTENDEE" nvarchar2(255)
+);
+
+create table SCHEDULE_AUTO_REPLY_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ICALENDAR_UID" nvarchar2(255),
+    "HOME_RESOURCE_ID" integer not null references CALENDAR_HOME on delete cascade,
+    "RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade,
+    "PARTSTAT" nvarchar2(255)
+);
+
+create table SCHEDULE_ORGANIZER_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ICALENDAR_UID" nvarchar2(255),
+    "SCHEDULE_ACTION" integer not null,
+    "HOME_RESOURCE_ID" integer not null references CALENDAR_HOME on delete cascade,
+    "RESOURCE_ID" integer,
+    "ICALENDAR_TEXT_OLD" nclob,
+    "ICALENDAR_TEXT_NEW" nclob,
+    "ATTENDEE_COUNT" integer,
+    "SMART_MERGE" integer
+);
+
+create table SCHEDULE_ACTION (
+    "ID" integer primary key,
+    "DESCRIPTION" nvarchar2(16) unique
+);
+
+insert into SCHEDULE_ACTION (DESCRIPTION, ID) values ('create', 0);
+insert into SCHEDULE_ACTION (DESCRIPTION, ID) values ('modify', 1);
+insert into SCHEDULE_ACTION (DESCRIPTION, ID) values ('modify-cancelled', 2);
+insert into SCHEDULE_ACTION (DESCRIPTION, ID) values ('remove', 3);
+create table SCHEDULE_REPLY_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ICALENDAR_UID" nvarchar2(255),
+    "HOME_RESOURCE_ID" integer not null references CALENDAR_HOME on delete cascade,
+    "RESOURCE_ID" integer not null references CALENDAR_OBJECT on delete cascade,
+    "CHANGED_RIDS" nclob
+);
+
+create table SCHEDULE_REPLY_CANCEL_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "ICALENDAR_UID" nvarchar2(255),
+    "HOME_RESOURCE_ID" integer not null references CALENDAR_HOME on delete cascade,
+    "ICALENDAR_TEXT" nclob
+);
+
+create table CALENDARSERVER (
+    "NAME" nvarchar2(255) primary key,
+    "VALUE" nvarchar2(255)
+);
+
+insert into CALENDARSERVER (NAME, VALUE) values ('VERSION', '34');
+insert into CALENDARSERVER (NAME, VALUE) values ('CALENDAR-DATAVERSION', '5');
+insert into CALENDARSERVER (NAME, VALUE) values ('ADDRESSBOOK-DATAVERSION', '2');
+insert into CALENDARSERVER (NAME, VALUE) values ('NOTIFICATION-DATAVERSION', '1');
+insert into CALENDARSERVER (NAME, VALUE) values ('MIN-VALID-REVISION', '1');
+create index CALENDAR_HOME_METADAT_3cb9049e on CALENDAR_HOME_METADATA (
+    DEFAULT_EVENTS
+);
+
+create index CALENDAR_HOME_METADAT_d55e5548 on CALENDAR_HOME_METADATA (
+    DEFAULT_TASKS
+);
+
+create index CALENDAR_HOME_METADAT_910264ce on CALENDAR_HOME_METADATA (
+    DEFAULT_POLLS
+);
+
+create index NOTIFICATION_NOTIFICA_f891f5f9 on NOTIFICATION (
+    NOTIFICATION_HOME_RESOURCE_ID
+);
+
+create index CALENDAR_BIND_RESOURC_e57964d4 on CALENDAR_BIND (
+    CALENDAR_RESOURCE_ID
+);
+
+create index CALENDAR_OBJECT_CALEN_a9a453a9 on CALENDAR_OBJECT (
+    CALENDAR_RESOURCE_ID,
+    ICALENDAR_UID
+);
+
+create index CALENDAR_OBJECT_CALEN_96e83b73 on CALENDAR_OBJECT (
+    CALENDAR_RESOURCE_ID,
+    RECURRANCE_MAX
+);
+
+create index CALENDAR_OBJECT_ICALE_82e731d5 on CALENDAR_OBJECT (
+    ICALENDAR_UID
+);
+
+create index CALENDAR_OBJECT_DROPB_de041d80 on CALENDAR_OBJECT (
+    DROPBOX_ID
+);
+
+create index TIME_RANGE_CALENDAR_R_beb6e7eb on TIME_RANGE (
+    CALENDAR_RESOURCE_ID
+);
+
+create index TIME_RANGE_CALENDAR_O_acf37bd1 on TIME_RANGE (
+    CALENDAR_OBJECT_RESOURCE_ID
+);
+
+create index TRANSPARENCY_TIME_RAN_5f34467f on TRANSPARENCY (
+    TIME_RANGE_INSTANCE_ID
+);
+
+create index ATTACHMENT_CALENDAR_H_0078845c on ATTACHMENT (
+    CALENDAR_HOME_RESOURCE_ID
+);
+
+create index ATTACHMENT_DROPBOX_ID_5073cf23 on ATTACHMENT (
+    DROPBOX_ID
+);
+
+create index ATTACHMENT_CALENDAR_O_81508484 on ATTACHMENT_CALENDAR_OBJECT (
+    CALENDAR_OBJECT_RESOURCE_ID
+);
+
+create index SHARED_ADDRESSBOOK_BI_e9a2e6d4 on SHARED_ADDRESSBOOK_BIND (
+    OWNER_HOME_RESOURCE_ID
+);
+
+create index ABO_MEMBERS_ADDRESSBO_4effa879 on ABO_MEMBERS (
+    ADDRESSBOOK_ID
+);
+
+create index ABO_MEMBERS_MEMBER_ID_8d66adcf on ABO_MEMBERS (
+    MEMBER_ID
+);
+
+create index ABO_FOREIGN_MEMBERS_A_1fd2c5e9 on ABO_FOREIGN_MEMBERS (
+    ADDRESSBOOK_ID
+);
+
+create index SHARED_GROUP_BIND_RES_cf52f95d on SHARED_GROUP_BIND (
+    GROUP_RESOURCE_ID
+);
+
+create index CALENDAR_OBJECT_REVIS_3a3956c4 on CALENDAR_OBJECT_REVISIONS (
+    CALENDAR_HOME_RESOURCE_ID,
+    CALENDAR_RESOURCE_ID
+);
+
+create index CALENDAR_OBJECT_REVIS_6d9d929c on CALENDAR_OBJECT_REVISIONS (
+    CALENDAR_RESOURCE_ID,
+    RESOURCE_NAME,
+    DELETED,
+    REVISION
+);
+
+create index CALENDAR_OBJECT_REVIS_265c8acf on CALENDAR_OBJECT_REVISIONS (
+    CALENDAR_RESOURCE_ID,
+    REVISION
+);
+
+create index ADDRESSBOOK_OBJECT_RE_2bfcf757 on ADDRESSBOOK_OBJECT_REVISIONS (
+    ADDRESSBOOK_HOME_RESOURCE_ID,
+    OWNER_HOME_RESOURCE_ID
+);
+
+create index ADDRESSBOOK_OBJECT_RE_00fe8288 on ADDRESSBOOK_OBJECT_REVISIONS (
+    OWNER_HOME_RESOURCE_ID,
+    RESOURCE_NAME,
+    DELETED,
+    REVISION
+);
+
+create index ADDRESSBOOK_OBJECT_RE_45004780 on ADDRESSBOOK_OBJECT_REVISIONS (
+    OWNER_HOME_RESOURCE_ID,
+    REVISION
+);
+
+create index NOTIFICATION_OBJECT_R_036a9cee on NOTIFICATION_OBJECT_REVISIONS (
+    NOTIFICATION_HOME_RESOURCE_ID,
+    REVISION
+);
+
+create index APN_SUBSCRIPTIONS_RES_9610d78e on APN_SUBSCRIPTIONS (
+    RESOURCE_KEY
+);
+
+create index IMIP_TOKENS_TOKEN_e94b918f on IMIP_TOKENS (
+    TOKEN
+);
+
+create index CALENDAR_OBJECT_SPLIT_af71dcda on CALENDAR_OBJECT_SPLITTER_WORK (
+    RESOURCE_ID
+);
+
+create index SCHEDULE_REFRESH_WORK_26084c7b on SCHEDULE_REFRESH_WORK (
+    HOME_RESOURCE_ID
+);
+
+create index SCHEDULE_REFRESH_WORK_989efe54 on SCHEDULE_REFRESH_WORK (
+    RESOURCE_ID
+);
+
+create index SCHEDULE_REFRESH_ATTE_83053b91 on SCHEDULE_REFRESH_ATTENDEES (
+    RESOURCE_ID,
+    ATTENDEE
+);
+
+create index SCHEDULE_AUTO_REPLY_W_0256478d on SCHEDULE_AUTO_REPLY_WORK (
+    HOME_RESOURCE_ID
+);
+
+create index SCHEDULE_AUTO_REPLY_W_0755e754 on SCHEDULE_AUTO_REPLY_WORK (
+    RESOURCE_ID
+);
+
+create index SCHEDULE_ORGANIZER_WO_18ce4edd on SCHEDULE_ORGANIZER_WORK (
+    HOME_RESOURCE_ID
+);
+
+create index SCHEDULE_ORGANIZER_WO_14702035 on SCHEDULE_ORGANIZER_WORK (
+    RESOURCE_ID
+);
+
+create index SCHEDULE_REPLY_WORK_H_745af8cf on SCHEDULE_REPLY_WORK (
+    HOME_RESOURCE_ID
+);
+
+create index SCHEDULE_REPLY_WORK_R_11bd3fbb on SCHEDULE_REPLY_WORK (
+    RESOURCE_ID
+);
+
+create index SCHEDULE_REPLY_CANCEL_dab513ef on SCHEDULE_REPLY_CANCEL_WORK (
+    HOME_RESOURCE_ID
+);
+

Added: CalendarServer/trunk/txdav/common/datastore/sql_schema/old/postgres-dialect/v34.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/old/postgres-dialect/v34.sql	                        (rev 0)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/old/postgres-dialect/v34.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,869 @@
+-- -*- test-case-name: txdav.caldav.datastore.test.test_sql,txdav.carddav.datastore.test.test_sql -*-
+
+----
+-- Copyright (c) 2010-2014 Apple Inc. All rights reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+----
+
+
+-----------------
+-- Resource ID --
+-----------------
+
+create sequence RESOURCE_ID_SEQ;
+
+
+-------------------------
+-- Cluster Bookkeeping --
+-------------------------
+
+-- Information about a process connected to this database.
+
+-- Note that this must match the node info schema in twext.enterprise.queue.
+create table NODE_INFO (
+  HOSTNAME  varchar(255) not null,
+  PID       integer      not null,
+  PORT      integer      not null,
+  TIME      timestamp    not null default timezone('UTC', CURRENT_TIMESTAMP),
+
+  primary key (HOSTNAME, PORT)
+);
+
+-- Unique named locks.  This table should always be empty, but rows are
+-- temporarily created in order to prevent undesirable concurrency.
+create table NAMED_LOCK (
+    LOCK_NAME varchar(255) primary key
+);
+
+
+-------------------
+-- Calendar Home --
+-------------------
+
+create table CALENDAR_HOME (
+  RESOURCE_ID      integer      primary key default nextval('RESOURCE_ID_SEQ'), -- implicit index
+  OWNER_UID        varchar(255) not null unique,                                -- implicit index
+  STATUS           integer      default 0 not null,                             -- enum HOME_STATUS
+  DATAVERSION      integer      default 0 not null
+);
+
+-- Enumeration of statuses
+
+create table HOME_STATUS (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into HOME_STATUS values (0, 'normal' );
+insert into HOME_STATUS values (1, 'external');
+
+
+--------------
+-- Calendar --
+--------------
+
+create table CALENDAR (
+  RESOURCE_ID integer   primary key default nextval('RESOURCE_ID_SEQ') -- implicit index
+);
+
+
+----------------------------
+-- Calendar Home Metadata --
+----------------------------
+
+create table CALENDAR_HOME_METADATA (
+  RESOURCE_ID              integer     primary key references CALENDAR_HOME on delete cascade, -- implicit index
+  QUOTA_USED_BYTES         integer     default 0 not null,
+  DEFAULT_EVENTS           integer     default null references CALENDAR on delete set null,
+  DEFAULT_TASKS            integer     default null references CALENDAR on delete set null,
+  DEFAULT_POLLS            integer     default null references CALENDAR on delete set null,
+  ALARM_VEVENT_TIMED       text        default null,
+  ALARM_VEVENT_ALLDAY      text        default null,
+  ALARM_VTODO_TIMED        text        default null,
+  ALARM_VTODO_ALLDAY       text        default null,
+  AVAILABILITY             text        default null,
+  CREATED                  timestamp   default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                 timestamp   default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+create index CALENDAR_HOME_METADATA_DEFAULT_EVENTS on
+	CALENDAR_HOME_METADATA(DEFAULT_EVENTS);
+create index CALENDAR_HOME_METADATA_DEFAULT_TASKS on
+	CALENDAR_HOME_METADATA(DEFAULT_TASKS);
+create index CALENDAR_HOME_METADATA_DEFAULT_POLLS on
+	CALENDAR_HOME_METADATA(DEFAULT_POLLS);
+
+
+-----------------------
+-- Calendar Metadata --
+-----------------------
+
+create table CALENDAR_METADATA (
+  RESOURCE_ID           integer      primary key references CALENDAR on delete cascade, -- implicit index
+  SUPPORTED_COMPONENTS  varchar(255) default null,
+  CREATED               timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED              timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+
+---------------------------
+-- Sharing Notifications --
+---------------------------
+
+create table NOTIFICATION_HOME (
+  RESOURCE_ID integer      primary key default nextval('RESOURCE_ID_SEQ'), -- implicit index
+  OWNER_UID   varchar(255) not null unique,                                -- implicit index
+  STATUS      integer      default 0 not null,                             -- enum HOME_STATUS
+  DATAVERSION integer      default 0 not null
+);
+
+create table NOTIFICATION (
+  RESOURCE_ID                   integer      primary key default nextval('RESOURCE_ID_SEQ'), -- implicit index
+  NOTIFICATION_HOME_RESOURCE_ID integer      not null references NOTIFICATION_HOME,
+  NOTIFICATION_UID              varchar(255) not null,
+  NOTIFICATION_TYPE             varchar(255) not null,
+  NOTIFICATION_DATA             text         not null,
+  MD5                           char(32)     not null,
+  CREATED                       timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                      timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+
+  unique(NOTIFICATION_UID, NOTIFICATION_HOME_RESOURCE_ID) -- implicit index
+);
+
+create index NOTIFICATION_NOTIFICATION_HOME_RESOURCE_ID on
+	NOTIFICATION(NOTIFICATION_HOME_RESOURCE_ID);
+
+
+-------------------
+-- Calendar Bind --
+-------------------
+
+-- Joins CALENDAR_HOME and CALENDAR
+
+create table CALENDAR_BIND (
+  CALENDAR_HOME_RESOURCE_ID integer      not null references CALENDAR_HOME,
+  CALENDAR_RESOURCE_ID      integer      not null references CALENDAR on delete cascade,
+  EXTERNAL_ID			    integer      default null,
+  CALENDAR_RESOURCE_NAME    varchar(255) not null,
+  BIND_MODE                 integer      not null, -- enum CALENDAR_BIND_MODE
+  BIND_STATUS               integer      not null, -- enum CALENDAR_BIND_STATUS
+  BIND_REVISION				integer      default 0 not null,
+  MESSAGE                   text,
+  TRANSP                    integer      default 0 not null, -- enum CALENDAR_TRANSP
+  ALARM_VEVENT_TIMED        text         default null,
+  ALARM_VEVENT_ALLDAY       text         default null,
+  ALARM_VTODO_TIMED         text         default null,
+  ALARM_VTODO_ALLDAY        text         default null,
+  TIMEZONE                  text         default null,
+
+  primary key(CALENDAR_HOME_RESOURCE_ID, CALENDAR_RESOURCE_ID), -- implicit index
+  unique(CALENDAR_HOME_RESOURCE_ID, CALENDAR_RESOURCE_NAME)     -- implicit index
+);
+
+create index CALENDAR_BIND_RESOURCE_ID on
+	CALENDAR_BIND(CALENDAR_RESOURCE_ID);
+
+-- Enumeration of calendar bind modes
+
+create table CALENDAR_BIND_MODE (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into CALENDAR_BIND_MODE values (0, 'own'  );
+insert into CALENDAR_BIND_MODE values (1, 'read' );
+insert into CALENDAR_BIND_MODE values (2, 'write');
+insert into CALENDAR_BIND_MODE values (3, 'direct');
+insert into CALENDAR_BIND_MODE values (4, 'indirect');
+
+-- Enumeration of statuses
+
+create table CALENDAR_BIND_STATUS (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into CALENDAR_BIND_STATUS values (0, 'invited' );
+insert into CALENDAR_BIND_STATUS values (1, 'accepted');
+insert into CALENDAR_BIND_STATUS values (2, 'declined');
+insert into CALENDAR_BIND_STATUS values (3, 'invalid');
+insert into CALENDAR_BIND_STATUS values (4, 'deleted');
+
+
+-- Enumeration of transparency
+
+create table CALENDAR_TRANSP (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into CALENDAR_TRANSP values (0, 'opaque' );
+insert into CALENDAR_TRANSP values (1, 'transparent');
+
+
+---------------------
+-- Calendar Object --
+---------------------
+
+create table CALENDAR_OBJECT (
+  RESOURCE_ID          integer      primary key default nextval('RESOURCE_ID_SEQ'), -- implicit index
+  CALENDAR_RESOURCE_ID integer      not null references CALENDAR on delete cascade,
+  RESOURCE_NAME        varchar(255) not null,
+  ICALENDAR_TEXT       text         not null,
+  ICALENDAR_UID        varchar(255) not null,
+  ICALENDAR_TYPE       varchar(255) not null,
+  ATTACHMENTS_MODE     integer      default 0 not null, -- enum CALENDAR_OBJECT_ATTACHMENTS_MODE
+  DROPBOX_ID           varchar(255),
+  ORGANIZER            varchar(255),
+  RECURRANCE_MIN       date,        -- minimum date that recurrences have been expanded to.
+  RECURRANCE_MAX       date,        -- maximum date that recurrences have been expanded to.
+  ACCESS               integer      default 0 not null,
+  SCHEDULE_OBJECT      boolean      default false,
+  SCHEDULE_TAG         varchar(36)  default null,
+  SCHEDULE_ETAGS       text         default null,
+  PRIVATE_COMMENTS     boolean      default false not null,
+  MD5                  char(32)     not null,
+  CREATED              timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED             timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+
+  unique (CALENDAR_RESOURCE_ID, RESOURCE_NAME) -- implicit index
+
+  -- since the 'inbox' is a 'calendar resource' for the purpose of storing
+  -- calendar objects, this constraint has to be selectively enforced by the
+  -- application layer.
+
+  -- unique(CALENDAR_RESOURCE_ID, ICALENDAR_UID)
+);
+
+create index CALENDAR_OBJECT_CALENDAR_RESOURCE_ID_AND_ICALENDAR_UID on
+  CALENDAR_OBJECT(CALENDAR_RESOURCE_ID, ICALENDAR_UID);
+
+create index CALENDAR_OBJECT_CALENDAR_RESOURCE_ID_RECURRANCE_MAX on
+  CALENDAR_OBJECT(CALENDAR_RESOURCE_ID, RECURRANCE_MAX);
+
+create index CALENDAR_OBJECT_ICALENDAR_UID on
+  CALENDAR_OBJECT(ICALENDAR_UID);
+
+create index CALENDAR_OBJECT_DROPBOX_ID on
+  CALENDAR_OBJECT(DROPBOX_ID);
+
+-- Enumeration of attachment modes
+
+create table CALENDAR_OBJECT_ATTACHMENTS_MODE (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into CALENDAR_OBJECT_ATTACHMENTS_MODE values (0, 'none' );
+insert into CALENDAR_OBJECT_ATTACHMENTS_MODE values (1, 'read' );
+insert into CALENDAR_OBJECT_ATTACHMENTS_MODE values (2, 'write');
+
+
+-- Enumeration of calendar access types
+
+create table CALENDAR_ACCESS_TYPE (
+  ID          integer     primary key,
+  DESCRIPTION varchar(32) not null unique
+);
+
+insert into CALENDAR_ACCESS_TYPE values (0, ''             );
+insert into CALENDAR_ACCESS_TYPE values (1, 'public'       );
+insert into CALENDAR_ACCESS_TYPE values (2, 'private'      );
+insert into CALENDAR_ACCESS_TYPE values (3, 'confidential' );
+insert into CALENDAR_ACCESS_TYPE values (4, 'restricted'   );
+
+
+-----------------
+-- Instance ID --
+-----------------
+
+create sequence INSTANCE_ID_SEQ;
+
+
+----------------
+-- Time Range --
+----------------
+
+create table TIME_RANGE (
+  INSTANCE_ID                 integer        primary key default nextval('INSTANCE_ID_SEQ'), -- implicit index
+  CALENDAR_RESOURCE_ID        integer        not null references CALENDAR on delete cascade,
+  CALENDAR_OBJECT_RESOURCE_ID integer        not null references CALENDAR_OBJECT on delete cascade,
+  FLOATING                    boolean        not null,
+  START_DATE                  timestamp      not null,
+  END_DATE                    timestamp      not null,
+  FBTYPE                      integer        not null,
+  TRANSPARENT                 boolean        not null
+);
+
+create index TIME_RANGE_CALENDAR_RESOURCE_ID on
+  TIME_RANGE(CALENDAR_RESOURCE_ID);
+create index TIME_RANGE_CALENDAR_OBJECT_RESOURCE_ID on
+  TIME_RANGE(CALENDAR_OBJECT_RESOURCE_ID);
+
+
+-- Enumeration of free/busy types
+
+create table FREE_BUSY_TYPE (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into FREE_BUSY_TYPE values (0, 'unknown'         );
+insert into FREE_BUSY_TYPE values (1, 'free'            );
+insert into FREE_BUSY_TYPE values (2, 'busy'            );
+insert into FREE_BUSY_TYPE values (3, 'busy-unavailable');
+insert into FREE_BUSY_TYPE values (4, 'busy-tentative'  );
+
+
+------------------
+-- Transparency --
+------------------
+
+create table TRANSPARENCY (
+  TIME_RANGE_INSTANCE_ID      integer      not null references TIME_RANGE on delete cascade,
+  USER_ID                     varchar(255) not null,
+  TRANSPARENT                 boolean      not null
+);
+
+create index TRANSPARENCY_TIME_RANGE_INSTANCE_ID on
+  TRANSPARENCY(TIME_RANGE_INSTANCE_ID);
+
+
+----------------
+-- Attachment --
+----------------
+
+create sequence ATTACHMENT_ID_SEQ;
+
+create table ATTACHMENT (
+  ATTACHMENT_ID               integer           primary key default nextval('ATTACHMENT_ID_SEQ'), -- implicit index
+  CALENDAR_HOME_RESOURCE_ID   integer           not null references CALENDAR_HOME,
+  DROPBOX_ID                  varchar(255),
+  CONTENT_TYPE                varchar(255)      not null,
+  SIZE                        integer           not null,
+  MD5                         char(32)          not null,
+  CREATED                     timestamp default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                    timestamp default timezone('UTC', CURRENT_TIMESTAMP),
+  PATH                        varchar(1024)     not null
+);
+
+create index ATTACHMENT_CALENDAR_HOME_RESOURCE_ID on
+  ATTACHMENT(CALENDAR_HOME_RESOURCE_ID);
+
+create index ATTACHMENT_DROPBOX_ID on
+  ATTACHMENT(DROPBOX_ID);
+
+-- Many-to-many relationship between attachments and calendar objects
+create table ATTACHMENT_CALENDAR_OBJECT (
+  ATTACHMENT_ID                  integer      not null references ATTACHMENT on delete cascade,
+  MANAGED_ID                     varchar(255) not null,
+  CALENDAR_OBJECT_RESOURCE_ID    integer      not null references CALENDAR_OBJECT on delete cascade,
+
+  primary key (ATTACHMENT_ID, CALENDAR_OBJECT_RESOURCE_ID), -- implicit index
+  unique (MANAGED_ID, CALENDAR_OBJECT_RESOURCE_ID) --implicit index
+);
+
+create index ATTACHMENT_CALENDAR_OBJECT_CALENDAR_OBJECT_RESOURCE_ID on
+	ATTACHMENT_CALENDAR_OBJECT(CALENDAR_OBJECT_RESOURCE_ID);
+
+-----------------------
+-- Resource Property --
+-----------------------
+
+create table RESOURCE_PROPERTY (
+  RESOURCE_ID integer      not null, -- foreign key: *.RESOURCE_ID
+  NAME        varchar(255) not null,
+  VALUE       text         not null, -- FIXME: xml?
+  VIEWER_UID  varchar(255),
+
+  primary key (RESOURCE_ID, NAME, VIEWER_UID) -- implicit index
+);
+
+
+----------------------
+-- AddressBook Home --
+----------------------
+
+create table ADDRESSBOOK_HOME (
+  RESOURCE_ID      				integer			primary key default nextval('RESOURCE_ID_SEQ'), -- implicit index
+  ADDRESSBOOK_PROPERTY_STORE_ID	integer      	default nextval('RESOURCE_ID_SEQ') not null, 	-- implicit index
+  OWNER_UID        				varchar(255) 	not null unique,                                -- implicit index
+  STATUS           				integer      	default 0 not null,                             -- enum HOME_STATUS
+  DATAVERSION      				integer      	default 0 not null
+);
+
+
+-------------------------------
+-- AddressBook Home Metadata --
+-------------------------------
+
+create table ADDRESSBOOK_HOME_METADATA (
+  RESOURCE_ID      integer      primary key references ADDRESSBOOK_HOME on delete cascade, -- implicit index
+  QUOTA_USED_BYTES integer      default 0 not null,
+  CREATED          timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED         timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+
+-----------------------------
+-- Shared AddressBook Bind --
+-----------------------------
+
+-- Joins sharee ADDRESSBOOK_HOME and owner ADDRESSBOOK_HOME
+
+create table SHARED_ADDRESSBOOK_BIND (
+  ADDRESSBOOK_HOME_RESOURCE_ID			integer			not null references ADDRESSBOOK_HOME,
+  OWNER_HOME_RESOURCE_ID    			integer      	not null references ADDRESSBOOK_HOME on delete cascade,
+  EXTERNAL_ID			                integer         default null,
+  ADDRESSBOOK_RESOURCE_NAME    			varchar(255) 	not null,
+  BIND_MODE                    			integer      	not null,	-- enum CALENDAR_BIND_MODE
+  BIND_STATUS                  			integer      	not null,	-- enum CALENDAR_BIND_STATUS
+  BIND_REVISION				   			integer      	default 0 not null,
+  MESSAGE                      			text,                  		-- FIXME: xml?
+
+  primary key (ADDRESSBOOK_HOME_RESOURCE_ID, OWNER_HOME_RESOURCE_ID), -- implicit index
+  unique (ADDRESSBOOK_HOME_RESOURCE_ID, ADDRESSBOOK_RESOURCE_NAME)     -- implicit index
+);
+
+create index SHARED_ADDRESSBOOK_BIND_RESOURCE_ID on
+  SHARED_ADDRESSBOOK_BIND(OWNER_HOME_RESOURCE_ID);
+
+
+------------------------
+-- AddressBook Object --
+------------------------
+
+create table ADDRESSBOOK_OBJECT (
+  RESOURCE_ID             		integer   		primary key default nextval('RESOURCE_ID_SEQ'),    -- implicit index
+  ADDRESSBOOK_HOME_RESOURCE_ID 	integer      	not null references ADDRESSBOOK_HOME on delete cascade,
+  RESOURCE_NAME           		varchar(255) 	not null,
+  VCARD_TEXT              		text         	not null,
+  VCARD_UID               		varchar(255) 	not null,
+  KIND 			  		  		integer      	not null,  -- enum ADDRESSBOOK_OBJECT_KIND
+  MD5                     		char(32)     	not null,
+  CREATED                 		timestamp    	default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                		timestamp    	default timezone('UTC', CURRENT_TIMESTAMP),
+
+  unique (ADDRESSBOOK_HOME_RESOURCE_ID, RESOURCE_NAME), -- implicit index
+  unique (ADDRESSBOOK_HOME_RESOURCE_ID, VCARD_UID)      -- implicit index
+);
+
+
+-----------------------------
+-- AddressBook Object kind --
+-----------------------------
+
+create table ADDRESSBOOK_OBJECT_KIND (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into ADDRESSBOOK_OBJECT_KIND values (0, 'person');
+insert into ADDRESSBOOK_OBJECT_KIND values (1, 'group' );
+insert into ADDRESSBOOK_OBJECT_KIND values (2, 'resource');
+insert into ADDRESSBOOK_OBJECT_KIND values (3, 'location');
+
+
+----------------------------------
+-- Revisions, forward reference --
+----------------------------------
+
+create sequence REVISION_SEQ;
+
+---------------------------------
+-- Address Book Object Members --
+---------------------------------
+
+create table ABO_MEMBERS (
+    GROUP_ID   		integer		not null, -- references ADDRESSBOOK_OBJECT on delete cascade,	-- AddressBook Object's (kind=='group') RESOURCE_ID
+ 	ADDRESSBOOK_ID	integer		not null references ADDRESSBOOK_HOME on delete cascade,
+    MEMBER_ID      	integer		not null, -- references ADDRESSBOOK_OBJECT,						-- member AddressBook Object's RESOURCE_ID
+  	REVISION        integer   	default nextval('REVISION_SEQ') not null,
+  	REMOVED        	boolean		default false not null,
+	MODIFIED        timestamp	default timezone('UTC', CURRENT_TIMESTAMP),
+
+    primary key (GROUP_ID, MEMBER_ID, REVISION) -- implicit index
+);
+
+create index ABO_MEMBERS_ADDRESSBOOK_ID on
+	ABO_MEMBERS(ADDRESSBOOK_ID);
+create index ABO_MEMBERS_MEMBER_ID on
+	ABO_MEMBERS(MEMBER_ID);
+
+------------------------------------------
+-- Address Book Object Foreign Members  --
+------------------------------------------
+
+create table ABO_FOREIGN_MEMBERS (
+    GROUP_ID              integer      not null references ADDRESSBOOK_OBJECT on delete cascade,	-- AddressBook Object's (kind=='group') RESOURCE_ID
+ 	ADDRESSBOOK_ID		  integer      not null references ADDRESSBOOK_HOME on delete cascade,
+    MEMBER_ADDRESS  	  varchar(255) not null, 													-- member AddressBook Object's 'calendar' address
+
+    primary key (GROUP_ID, MEMBER_ADDRESS) -- implicit index
+);
+
+create index ABO_FOREIGN_MEMBERS_ADDRESSBOOK_ID on
+	ABO_FOREIGN_MEMBERS(ADDRESSBOOK_ID);
+
+-----------------------
+-- Shared Group Bind --
+-----------------------
+
+-- Joins ADDRESSBOOK_HOME and ADDRESSBOOK_OBJECT (kind == group)
+
+create table SHARED_GROUP_BIND (	
+  ADDRESSBOOK_HOME_RESOURCE_ID 		integer      not null references ADDRESSBOOK_HOME,
+  GROUP_RESOURCE_ID      			integer      not null references ADDRESSBOOK_OBJECT on delete cascade,
+  EXTERNAL_ID			            integer      default null,
+  GROUP_ADDRESSBOOK_NAME			varchar(255) not null,
+  BIND_MODE                    		integer      not null, -- enum CALENDAR_BIND_MODE
+  BIND_STATUS                  		integer      not null, -- enum CALENDAR_BIND_STATUS
+  BIND_REVISION				   		integer      default 0 not null,
+  MESSAGE                      		text,                  -- FIXME: xml?
+
+  primary key (ADDRESSBOOK_HOME_RESOURCE_ID, GROUP_RESOURCE_ID), -- implicit index
+  unique (ADDRESSBOOK_HOME_RESOURCE_ID, GROUP_ADDRESSBOOK_NAME)  -- implicit index
+);
+
+create index SHARED_GROUP_BIND_RESOURCE_ID on
+  SHARED_GROUP_BIND(GROUP_RESOURCE_ID);
+
+
+---------------
+-- Revisions --
+---------------
+
+-- create sequence REVISION_SEQ;
+
+
+-------------------------------
+-- Calendar Object Revisions --
+-------------------------------
+
+create table CALENDAR_OBJECT_REVISIONS (
+  CALENDAR_HOME_RESOURCE_ID integer      not null references CALENDAR_HOME,
+  CALENDAR_RESOURCE_ID      integer      references CALENDAR,
+  CALENDAR_NAME             varchar(255) default null,
+  RESOURCE_NAME             varchar(255),
+  REVISION                  integer      default nextval('REVISION_SEQ') not null,
+  DELETED                   boolean      not null,
+  MODIFIED                  timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+create index CALENDAR_OBJECT_REVISIONS_HOME_RESOURCE_ID_CALENDAR_RESOURCE_ID
+  on CALENDAR_OBJECT_REVISIONS(CALENDAR_HOME_RESOURCE_ID, CALENDAR_RESOURCE_ID);
+
+create index CALENDAR_OBJECT_REVISIONS_RESOURCE_ID_RESOURCE_NAME_DELETED_REVISION
+  on CALENDAR_OBJECT_REVISIONS(CALENDAR_RESOURCE_ID, RESOURCE_NAME, DELETED, REVISION);
+
+create index CALENDAR_OBJECT_REVISIONS_RESOURCE_ID_REVISION
+  on CALENDAR_OBJECT_REVISIONS(CALENDAR_RESOURCE_ID, REVISION);
+
+
+----------------------------------
+-- AddressBook Object Revisions --
+----------------------------------
+
+create table ADDRESSBOOK_OBJECT_REVISIONS (
+  ADDRESSBOOK_HOME_RESOURCE_ID 	integer		 not null references ADDRESSBOOK_HOME,
+  OWNER_HOME_RESOURCE_ID    	integer      references ADDRESSBOOK_HOME,
+  ADDRESSBOOK_NAME             	varchar(255) default null,
+  OBJECT_RESOURCE_ID			integer		 default 0,
+  RESOURCE_NAME                	varchar(255),
+  REVISION                     	integer      default nextval('REVISION_SEQ') not null,
+  DELETED                      	boolean   	 not null,
+  MODIFIED                  	timestamp 	 default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+create index ADDRESSBOOK_OBJECT_REVISIONS_HOME_RESOURCE_ID_OWNER_HOME_RESOURCE_ID
+  on ADDRESSBOOK_OBJECT_REVISIONS(ADDRESSBOOK_HOME_RESOURCE_ID, OWNER_HOME_RESOURCE_ID);
+
+create index ADDRESSBOOK_OBJECT_REVISIONS_OWNER_HOME_RESOURCE_ID_RESOURCE_NAME_DELETED_REVISION
+  on ADDRESSBOOK_OBJECT_REVISIONS(OWNER_HOME_RESOURCE_ID, RESOURCE_NAME, DELETED, REVISION);
+
+create index ADDRESSBOOK_OBJECT_REVISIONS_OWNER_HOME_RESOURCE_ID_REVISION
+  on ADDRESSBOOK_OBJECT_REVISIONS(OWNER_HOME_RESOURCE_ID, REVISION);
+
+
+-----------------------------------
+-- Notification Object Revisions --
+-----------------------------------
+
+create table NOTIFICATION_OBJECT_REVISIONS (
+  NOTIFICATION_HOME_RESOURCE_ID integer      not null references NOTIFICATION_HOME on delete cascade,
+  RESOURCE_NAME                 varchar(255),
+  REVISION                      integer      default nextval('REVISION_SEQ') not null,
+  DELETED                       boolean      not null,
+  MODIFIED                  	timestamp	 default timezone('UTC', CURRENT_TIMESTAMP),
+
+  unique(NOTIFICATION_HOME_RESOURCE_ID, RESOURCE_NAME) -- implicit index
+);
+
+create index NOTIFICATION_OBJECT_REVISIONS_RESOURCE_ID_REVISION
+  on NOTIFICATION_OBJECT_REVISIONS(NOTIFICATION_HOME_RESOURCE_ID, REVISION);
+
+
+-------------------------------------------
+-- Apple Push Notification Subscriptions --
+-------------------------------------------
+
+create table APN_SUBSCRIPTIONS (
+  TOKEN                         varchar(255) not null,
+  RESOURCE_KEY                  varchar(255) not null,
+  MODIFIED                      integer      not null,
+  SUBSCRIBER_GUID               varchar(255) not null,
+  USER_AGENT                    varchar(255) default null,
+  IP_ADDR                       varchar(255) default null,
+
+  primary key (TOKEN, RESOURCE_KEY) -- implicit index
+);
+
+create index APN_SUBSCRIPTIONS_RESOURCE_KEY
+   on APN_SUBSCRIPTIONS(RESOURCE_KEY);
+
+   
+-----------------
+-- IMIP Tokens --
+-----------------
+
+create table IMIP_TOKENS (
+  TOKEN                         varchar(255) not null,
+  ORGANIZER                     varchar(255) not null,
+  ATTENDEE                      varchar(255) not null,
+  ICALUID                       varchar(255) not null,
+  ACCESSED                      timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+
+  primary key (ORGANIZER, ATTENDEE, ICALUID) -- implicit index
+);
+
+create index IMIP_TOKENS_TOKEN
+   on IMIP_TOKENS(TOKEN);
+
+   
+----------------
+-- Work Items --
+----------------
+
+create sequence WORKITEM_SEQ;
+
+
+---------------------------
+-- IMIP Inivitation Work --
+---------------------------
+
+create table IMIP_INVITATION_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  FROM_ADDR                     varchar(255) not null,
+  TO_ADDR                       varchar(255) not null,
+  ICALENDAR_TEXT                text         not null
+);
+
+
+-----------------------
+-- IMIP Polling Work --
+-----------------------
+
+create table IMIP_POLLING_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+
+---------------------
+-- IMIP Reply Work --
+---------------------
+
+create table IMIP_REPLY_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ORGANIZER                     varchar(255) not null,
+  ATTENDEE                      varchar(255) not null,
+  ICALENDAR_TEXT                text         not null
+);
+
+
+------------------------
+-- Push Notifications --
+------------------------
+
+create table PUSH_NOTIFICATION_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  PUSH_ID                       varchar(255) not null,
+  PRIORITY                      integer      not null -- 1:low 5:medium 10:high
+);
+
+-----------------
+-- GroupCacher --
+-----------------
+
+create table GROUP_CACHER_POLLING_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+
+--------------------------
+-- Object Splitter Work --
+--------------------------
+
+create table CALENDAR_OBJECT_SPLITTER_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  RESOURCE_ID                   integer      not null references CALENDAR_OBJECT on delete cascade
+);
+
+create index CALENDAR_OBJECT_SPLITTER_WORK_RESOURCE_ID on
+	CALENDAR_OBJECT_SPLITTER_WORK(RESOURCE_ID);
+
+---------------------------
+-- Revision Cleaner Work --
+---------------------------
+
+create table FIND_MIN_VALID_REVISION_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+create table REVISION_CLEANUP_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP)
+);
+
+---------------------------
+-- Schedule Refresh Work --
+---------------------------
+
+create table SCHEDULE_REFRESH_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ICALENDAR_UID        			varchar(255) not null,
+  HOME_RESOURCE_ID              integer      not null references CALENDAR_HOME on delete cascade,
+  RESOURCE_ID                   integer      not null references CALENDAR_OBJECT on delete cascade,
+  ATTENDEE_COUNT				integer
+);
+
+create index SCHEDULE_REFRESH_WORK_HOME_RESOURCE_ID on
+	SCHEDULE_REFRESH_WORK(HOME_RESOURCE_ID);
+create index SCHEDULE_REFRESH_WORK_RESOURCE_ID on
+	SCHEDULE_REFRESH_WORK(RESOURCE_ID);
+
+create table SCHEDULE_REFRESH_ATTENDEES (
+  RESOURCE_ID                   integer      not null references CALENDAR_OBJECT on delete cascade,
+  ATTENDEE			            varchar(255) not null
+);
+
+create index SCHEDULE_REFRESH_ATTENDEES_RESOURCE_ID_ATTENDEE on
+	SCHEDULE_REFRESH_ATTENDEES(RESOURCE_ID, ATTENDEE);
+
+------------------------------
+-- Schedule Auto Reply Work --
+------------------------------
+
+create table SCHEDULE_AUTO_REPLY_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ICALENDAR_UID        			varchar(255) not null,
+  HOME_RESOURCE_ID              integer      not null references CALENDAR_HOME on delete cascade,
+  RESOURCE_ID                   integer      not null references CALENDAR_OBJECT on delete cascade,
+  PARTSTAT						varchar(255) not null
+);
+
+create index SCHEDULE_AUTO_REPLY_WORK_HOME_RESOURCE_ID on
+	SCHEDULE_AUTO_REPLY_WORK(HOME_RESOURCE_ID);
+create index SCHEDULE_AUTO_REPLY_WORK_RESOURCE_ID on
+	SCHEDULE_AUTO_REPLY_WORK(RESOURCE_ID);
+
+-----------------------------
+-- Schedule Organizer Work --
+-----------------------------
+
+create table SCHEDULE_ORGANIZER_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ICALENDAR_UID        			varchar(255) not null,
+  SCHEDULE_ACTION				integer		 not null, -- Enum SCHEDULE_ACTION
+  HOME_RESOURCE_ID              integer      not null references CALENDAR_HOME on delete cascade,
+  RESOURCE_ID                   integer,	 -- this references a possibly non-existent CALENDR_OBJECT
+  ICALENDAR_TEXT_OLD			text,
+  ICALENDAR_TEXT_NEW			text,
+  ATTENDEE_COUNT				integer,
+  SMART_MERGE					boolean
+);
+
+create index SCHEDULE_ORGANIZER_WORK_HOME_RESOURCE_ID on
+	SCHEDULE_ORGANIZER_WORK(HOME_RESOURCE_ID);
+create index SCHEDULE_ORGANIZER_WORK_RESOURCE_ID on
+	SCHEDULE_ORGANIZER_WORK(RESOURCE_ID);
+
+-- Enumeration of schedule actions
+
+create table SCHEDULE_ACTION (
+  ID          integer     primary key,
+  DESCRIPTION varchar(16) not null unique
+);
+
+insert into SCHEDULE_ACTION values (0, 'create');
+insert into SCHEDULE_ACTION values (1, 'modify');
+insert into SCHEDULE_ACTION values (2, 'modify-cancelled');
+insert into SCHEDULE_ACTION values (3, 'remove');
+
+-------------------------
+-- Schedule Reply Work --
+-------------------------
+
+create table SCHEDULE_REPLY_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ICALENDAR_UID        			varchar(255) not null,
+  HOME_RESOURCE_ID              integer      not null references CALENDAR_HOME on delete cascade,
+  RESOURCE_ID                   integer      not null references CALENDAR_OBJECT on delete cascade,
+  CHANGED_RIDS       			text
+);
+
+create index SCHEDULE_REPLY_WORK_HOME_RESOURCE_ID on
+	SCHEDULE_REPLY_WORK(HOME_RESOURCE_ID);
+create index SCHEDULE_REPLY_WORK_RESOURCE_ID on
+	SCHEDULE_REPLY_WORK(RESOURCE_ID);
+
+--------------------------------
+-- Schedule Reply Cancel Work --
+--------------------------------
+
+create table SCHEDULE_REPLY_CANCEL_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  ICALENDAR_UID        			varchar(255) not null,
+  HOME_RESOURCE_ID              integer      not null references CALENDAR_HOME on delete cascade,
+  ICALENDAR_TEXT       			text         not null
+);
+
+create index SCHEDULE_REPLY_CANCEL_WORK_HOME_RESOURCE_ID on
+	SCHEDULE_REPLY_CANCEL_WORK(HOME_RESOURCE_ID);
+
+--------------------
+-- Schema Version --
+--------------------
+
+create table CALENDARSERVER (
+  NAME                          varchar(255) primary key, -- implicit index
+  VALUE                         varchar(255)
+);
+
+insert into CALENDARSERVER values ('VERSION', '34');
+insert into CALENDARSERVER values ('CALENDAR-DATAVERSION', '5');
+insert into CALENDARSERVER values ('ADDRESSBOOK-DATAVERSION', '2');
+insert into CALENDARSERVER values ('NOTIFICATION-DATAVERSION', '1');
+insert into CALENDARSERVER values ('MIN-VALID-REVISION', '1');

Added: CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/oracle-dialect/upgrade_from_34_to_35.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/oracle-dialect/upgrade_from_34_to_35.sql	                        (rev 0)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/oracle-dialect/upgrade_from_34_to_35.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,92 @@
+----
+-- Copyright (c) 2012-2013 Apple Inc. All rights reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+----
+
+---------------------------------------------------
+-- Upgrade database schema from VERSION 34 to 35 --
+---------------------------------------------------
+
+create table GROUP_REFRESH_WORK (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "GROUP_GUID" nvarchar2(255)
+);
+
+create table GROUP_ATTENDEE_RECONCILIATION_ (
+    "WORK_ID" integer primary key not null,
+    "NOT_BEFORE" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "RESOURCE_ID" integer,
+    "GROUP_ID" integer
+);
+
+create table GROUPS (
+    "GROUP_ID" integer primary key,
+    "NAME" nvarchar2(255),
+    "GROUP_GUID" nvarchar2(255),
+    "MEMBERSHIP_HASH" nvarchar2(255),
+    "EXTANT" integer default 1,
+    "CREATED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC',
+    "MODIFIED" timestamp default CURRENT_TIMESTAMP at time zone 'UTC'
+);
+
+create table GROUP_MEMBERSHIP (
+    "GROUP_ID" integer,
+    "MEMBER_GUID" nvarchar2(255)
+);
+
+create table GROUP_ATTENDEE (
+    "GROUP_ID" integer,
+    "RESOURCE_ID" integer,
+    "MEMBERSHIP_HASH" nvarchar2(255)
+);
+
+create table DELEGATES (
+    "DELEGATOR" nvarchar2(255),
+    "DELEGATE" nvarchar2(255),
+    "READ_WRITE" integer not null
+);
+
+create table DELEGATE_GROUPS (
+    "DELEGATOR" nvarchar2(255),
+    "GROUP_ID" integer not null,
+    "READ_WRITE" integer not null,
+    "IS_EXTERNAL" integer not null
+);
+
+create table EXTERNAL_DELEGATE_GROUPS (
+    "DELEGATOR" nvarchar2(255),
+    "GROUP_GUID_READ" nvarchar2(255),
+    "GROUP_GUID_WRITE" nvarchar2(255)
+);
+
+
+create index GROUPS_GROUP_GUID_ebf7a1d4 on GROUPS (
+    GROUP_GUID
+);
+
+create index GROUP_MEMBERSHIP_GROU_9560a5e6 on GROUP_MEMBERSHIP (
+    GROUP_ID
+);
+
+create index GROUP_MEMBERSHIP_MEMB_0ca508e8 on GROUP_MEMBERSHIP (
+    MEMBER_GUID
+);
+
+
+-- Now update the version
+-- No data upgrades
+update CALENDARSERVER set VALUE = '35' where NAME = 'VERSION';
+
+

Added: CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/postgres-dialect/upgrade_from_34_to_35.sql
===================================================================
--- CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/postgres-dialect/upgrade_from_34_to_35.sql	                        (rev 0)
+++ CalendarServer/trunk/txdav/common/datastore/sql_schema/upgrades/postgres-dialect/upgrade_from_34_to_35.sql	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,87 @@
+----
+-- Copyright (c) 2012-2013 Apple Inc. All rights reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+----
+
+---------------------------------------------------
+-- Upgrade database schema from VERSION 34 to 35 --
+---------------------------------------------------
+
+----------------------
+-- Group membership --
+----------------------
+
+create table GROUP_REFRESH_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  GROUP_GUID                    varchar(255) not null
+);
+
+create table GROUP_ATTENDEE_RECONCILIATION_WORK (
+  WORK_ID                       integer      primary key default nextval('WORKITEM_SEQ') not null, -- implicit index
+  NOT_BEFORE                    timestamp    default timezone('UTC', CURRENT_TIMESTAMP),
+  RESOURCE_ID                   integer,
+  GROUP_ID                      integer
+);
+
+create table GROUPS (
+  GROUP_ID                      integer      primary key default nextval('RESOURCE_ID_SEQ'),    -- implicit index
+  NAME                          varchar(255) not null,
+  GROUP_GUID                    varchar(255) not null,
+  MEMBERSHIP_HASH               varchar(255) not null,
+  EXTANT                        integer default 1,
+  CREATED                       timestamp default timezone('UTC', CURRENT_TIMESTAMP),
+  MODIFIED                      timestamp default timezone('UTC', CURRENT_TIMESTAMP)
+);
+create index GROUPS_GROUP_GUID on GROUPS(GROUP_GUID);
+
+create table GROUP_MEMBERSHIP (
+  GROUP_ID                      integer,
+  MEMBER_GUID                   varchar(255) not null
+);
+create index GROUP_MEMBERSHIP_GROUP on GROUP_MEMBERSHIP(GROUP_ID);
+create index GROUP_MEMBERSHIP_MEMBER on GROUP_MEMBERSHIP(MEMBER_GUID);
+
+create table GROUP_ATTENDEE (
+  GROUP_ID                      integer,
+  RESOURCE_ID                   integer,
+  MEMBERSHIP_HASH               varchar(255) not null
+);
+
+---------------
+-- Delegates --
+---------------
+
+create table DELEGATES (
+  DELEGATOR                     varchar(255) not null,
+  DELEGATE                      varchar(255) not null,
+  READ_WRITE                    integer      not null -- 1 = ReadWrite, 0 = ReadOnly
+);
+
+create table DELEGATE_GROUPS (
+  DELEGATOR                     varchar(255) not null,
+  GROUP_ID                      integer      not null,
+  READ_WRITE                    integer      not null, -- 1 = ReadWrite, 0 = ReadOnly
+  IS_EXTERNAL                   integer      not null -- 1 = ReadWrite, 0 = ReadOnly
+);
+
+create table EXTERNAL_DELEGATE_GROUPS (
+  DELEGATOR                     varchar(255) not null,
+  GROUP_GUID_READ               varchar(255),
+  GROUP_GUID_WRITE              varchar(255)
+);
+
+-- Now update the version
+-- No data upgrades
+update CALENDARSERVER set VALUE = '35' where NAME = 'VERSION';

Added: CalendarServer/trunk/txdav/who/delegates.py
===================================================================
--- CalendarServer/trunk/txdav/who/delegates.py	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/delegates.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,124 @@
+# -*- test-case-name: twext.who.test.test_delegates -*-
+##
+# Copyright (c) 2013 Apple Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##
+
+"""
+Delegate assignments
+"""
+
+from twisted.internet.defer import inlineCallbacks, returnValue
+from twext.who.idirectory import RecordType
+
+from twext.python.log import Logger
+log = Logger()
+
+
+ at inlineCallbacks
+def addDelegate(txn, delegator, delegate, readWrite):
+    """
+    Adds "delegate" as a delegate of "delegator".  The type of access is
+    specified by the "readWrite" parameter.
+
+    @param delegator: the delegator's directory record
+    @type delegator: L{IDirectoryRecord}
+    @param delegate: the delegate's directory record
+    @type delegate: L{IDirectoryRecord}
+    @param readWrite: if True, read and write access is granted; read-only
+        access otherwise
+    """
+    if delegate.recordType == RecordType.group:
+        # find the groupID
+        groupID, name, membershipHash = (yield txn.groupByGUID(delegate.guid))
+        yield txn.addDelegateGroup(delegator.guid, groupID, readWrite)
+    else:
+        yield txn.addDelegate(delegator.guid, delegate.guid, readWrite)
+
+
+ at inlineCallbacks
+def removeDelegate(txn, delegator, delegate, readWrite):
+    """
+    Removes "delegate" as a delegate of "delegator".  The type of access is
+    specified by the "readWrite" parameter.
+
+    @param delegator: the delegator's directory record
+    @type delegator: L{IDirectoryRecord}
+    @param delegate: the delegate's directory record
+    @type delegate: L{IDirectoryRecord}
+    @param readWrite: if True, read and write access is revoked; read-only
+        access otherwise
+    """
+    if delegate.recordType == RecordType.group:
+        # find the groupID
+        groupID, name, membershipHash = (yield txn.groupByGUID(delegate.guid))
+        yield txn.removeDelegateGroup(delegator.guid, groupID, readWrite)
+    else:
+        yield txn.removeDelegate(delegator.guid, delegate.guid, readWrite)
+
+
+ at inlineCallbacks
+def delegatesOf(txn, delegator, readWrite):
+    """
+    Return the records of the delegates of "delegator".  The type of access
+    is specified by the "readWrite" parameter.
+
+    @param delegator: the delegator's directory record
+    @type delegator: L{IDirectoryRecord}
+    @param readWrite: if True, read and write access delegates are returned;
+        read-only access otherwise
+    @return: the set of directory records
+    @rtype: a Deferred which fires a set of L{IDirectoryRecord}
+    """
+    records = []
+    directory = delegator.service
+    delegateGUIDs = (yield txn.delegates(delegator.guid, readWrite))
+    for guid in delegateGUIDs:
+        if guid != delegator.guid:
+            record = (yield directory.recordWithGUID(guid))
+            if record is not None:
+                records.append(record)
+    returnValue(records)
+
+
+ at inlineCallbacks
+def delegatedTo(txn, delegate, readWrite):
+    """
+    Return the records of those who have delegated to "delegate".  The type of
+    access is specified by the "readWrite" parameter.
+
+    @param delegate: the delegate's directory record
+    @type delegate: L{IDirectoryRecord}
+    @param readWrite: if True, read and write access delegators are returned;
+        read-only access otherwise
+    @return: the set of directory records
+    @rtype: a Deferred which fires a set of L{IDirectoryRecord}
+    """
+    records = []
+    directory = delegate.service
+    delegatorGUIDs = (yield txn.delegators(delegate.guid, readWrite))
+    for guid in delegatorGUIDs:
+        if guid != delegate.guid:
+            record = (yield directory.recordWithGUID(guid))
+            if record is not None:
+                records.append(record)
+    returnValue(records)
+
+
+def allGroupDelegates(txn):
+    """
+    @return: the GUIDs of all groups which are currently delegated to
+    @rtype: a Deferred which fires with a set() of GUID strings
+    """
+    return txn.allGroupDelegates()

Added: CalendarServer/trunk/txdav/who/groups.py
===================================================================
--- CalendarServer/trunk/txdav/who/groups.py	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/groups.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,427 @@
+# -*- test-case-name: twext.who.test.test_groups -*-
+##
+# Copyright (c) 2013 Apple Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##
+
+"""
+Group membership caching
+"""
+
+from twext.enterprise.dal.record import fromTable
+from twext.enterprise.dal.syntax import Delete, Select
+from twext.enterprise.queue import WorkItem, PeerConnectionPool
+from txdav.who.delegates import allGroupDelegates
+from twext.who.idirectory import RecordType
+from twisted.internet.defer import inlineCallbacks, returnValue
+from txdav.common.datastore.sql_tables import schema
+import datetime
+import hashlib
+
+from twext.python.log import Logger
+log = Logger()
+
+
+class GroupCacherPollingWork(
+    WorkItem,
+    fromTable(schema.GROUP_CACHER_POLLING_WORK)
+):
+
+    group = "group_cacher_polling"
+
+    @inlineCallbacks
+    def doWork(self):
+
+        # Delete all other work items
+        yield Delete(From=self.table, Where=None).on(self.transaction)
+
+        oldGroupCacher = getattr(self.transaction, "_groupCacher", None)
+        newGroupCacher = getattr(self.transaction, "_newGroupCacher", None)
+        if oldGroupCacher is not None or newGroupCacher is not None:
+
+            # Schedule next update
+
+            # TODO: Be sure to move updateSeconds to the new cacher
+            # implementation
+            notBefore = (
+                datetime.datetime.utcnow() +
+                datetime.timedelta(seconds=oldGroupCacher.updateSeconds)
+            )
+            log.debug("Scheduling next group cacher update: %s" % (notBefore,))
+            yield self.transaction.enqueue(
+                GroupCacherPollingWork,
+                notBefore=notBefore
+            )
+
+            # New implmementation
+            try:
+                newGroupCacher.update(self.transaction)
+            except Exception, e:
+                log.error("Failed to update new group membership cache (%s)" % (e,))
+
+            # Old implmementation
+            try:
+                oldGroupCacher.updateCache()
+            except Exception, e:
+                log.error("Failed to update old group membership cache (%s)" % (e,))
+
+        else:
+            notBefore = (
+                datetime.datetime.utcnow() +
+                datetime.timedelta(seconds=10)
+            )
+            log.debug("Rescheduling group cacher update: %s" % (notBefore,))
+            yield self.transaction.enqueue(
+                GroupCacherPollingWork,
+                notBefore=notBefore
+            )
+
+
+
+ at inlineCallbacks
+def scheduleNextGroupCachingUpdate(store, seconds):
+    txn = store.newTransaction()
+    notBefore = datetime.datetime.utcnow() + datetime.timedelta(seconds=seconds)
+    log.debug("Scheduling next group cacher update: %s" % (notBefore,))
+    wp = (yield txn.enqueue(GroupCacherPollingWork, notBefore=notBefore))
+    yield txn.commit()
+    returnValue(wp)
+
+
+
+def schedulePolledGroupCachingUpdate(store):
+    """
+    Schedules a group caching update work item in "the past" so PeerConnectionPool's
+    overdue-item logic picks it up quickly.
+    """
+    seconds = -PeerConnectionPool.queueProcessTimeout
+    return scheduleNextGroupCachingUpdate(store, seconds)
+
+
+
+class GroupRefreshWork(WorkItem, fromTable(schema.GROUP_REFRESH_WORK)):
+
+    group = property(lambda self: self.groupGUID)
+
+    @inlineCallbacks
+    def doWork(self):
+
+        # Delete all other work items for this group
+        yield Delete(From=self.table, Where=(self.table.GROUP_GUID == self.groupGUID)).on(self.transaction)
+
+        groupCacher = getattr(self.transaction, "_groupCacher", None)
+        if groupCacher is not None:
+
+            try:
+                groupCacher.refreshGroup(self.transaction, self.groupGUID)
+            except Exception, e:
+                log.error(
+                    "Failed to refresh group {group} {err}",
+                    group=self.groupGUID, err=e
+                )
+
+        else:
+            notBefore = (
+                datetime.datetime.utcnow() +
+                datetime.timedelta(seconds=10)
+            )
+            log.debug(
+                "Rescheduling group refresh for {group}: {when}",
+                group=self.groupGUID, when=notBefore
+            )
+            yield self.transaction.enqueue(
+                GroupRefreshWork,
+                groupGUID=self.groupGUID, notBefore=notBefore
+            )
+
+
+
+class GroupAttendeeReconciliationWork(WorkItem, fromTable(schema.GROUP_ATTENDEE_RECONCILIATION_WORK)):
+
+    group = property(lambda self: "%s, %s" % (self.groupID, self.eventID))
+
+    @inlineCallbacks
+    def doWork(self):
+
+        # Delete all other work items for this group
+        yield Delete(
+            From=self.table,
+            Where=((self.table.GROUP_ID == self.self.groupID).And(
+                self.table.RESOURCE_ID == self.self.eventID)
+            )
+        ).on(self.transaction)
+
+    # TODO: Pull this over from groupcacher branch
+
+
+ at inlineCallbacks
+def expandedMembers(record, members=None, records=None):
+    """
+    Return the expanded set of member records.  Intermediate groups are not returned
+    in the results, but their members are.
+    """
+    if members is None:
+        members = set()
+    if records is None:
+        records = set()
+
+    if record not in records:
+        records.add(record)
+        for member in (yield record.members()):
+            if member not in records:
+                #TODO:  HACK for old-style XML. FIX
+                if member.recordType != RecordType.group and str(member.recordType) != "groups":
+                    members.add(member)
+                yield expandedMembers(member, members, records)
+
+    returnValue(members)
+
+
+def diffAssignments(old, new):
+    """
+    Compare two proxy assignment lists and return their differences in the form of
+    two lists -- one for added/updated assignments, and one for removed assignments.
+    @param old: dictionary of delegator: (readGroupGUID, writeGroupGUID)
+    @type old: C{dict}
+    @param new: dictionary of delegator: (readGroupGUID, writeGroupGUID)
+    @type new: C{dict}
+    @return: Tuple of two lists; the first list contains tuples of (delegator,
+        (readGroupGUID, writeGroupGUID)), and represents all the new or updated
+        assignments.  The second list contains all the delegators which used to
+        have a delegate but don't anymore.
+    """
+    changed = []
+    removed = []
+    for key in old.iterkeys():
+        if key not in new:
+            removed.append(key)
+        else:
+            if old[key] != new[key]:
+                changed.append((key, new[key]))
+    for key in new.iterkeys():
+        if key not in old:
+            changed.append((key, new[key]))
+    return changed, removed
+
+
+
+class GroupCacher(object):
+    log = Logger()
+
+    def __init__(
+        self, directory,
+        useExternalProxies=False, externalProxiesSource=None
+    ):
+        self.directory = directory
+        self.useExternalProxies = useExternalProxies
+        if useExternalProxies and externalProxiesSource is None:
+            externalProxiesSource = self.directory.getExternalProxyAssignments
+        self.externalProxiesSource = externalProxiesSource
+
+
+    @inlineCallbacks
+    def update(self, txn):
+        # TODO
+        # Pull in external delegate assignments and stick in delegate db
+        # if self.useExternalProxies:
+        #     externalAssignments = (yield self.externalProxiesSource())
+        # yield self.applyExternalAssignments(txn, externalAssignments)
+
+
+        # Figure out which groups matter
+        groupGUIDs = yield self.groupsToRefresh(txn)
+        self.log.debug(
+            "Number of groups to refresh: {num}".format(num=len(groupGUIDs))
+        )
+        # For each of those groups, create a per-group refresh work item
+        for groupGUID in groupGUIDs:
+            notBefore = (
+                datetime.datetime.utcnow() +
+                datetime.timedelta(seconds=1)
+            )
+            yield txn.enqueue(
+                GroupRefreshWork, groupGUID=groupGUID, notBefore=notBefore
+            )
+
+
+    @inlineCallbacks
+    def applyExternalAssignments(self, txn, newAssignments):
+
+        oldAssignments = (yield txn.externalDelegates())
+
+        """
+        external assignments is of the form:
+        { delegatorGUID: (readDelegateGroupGUID, writeDelegateGroupGUID),
+        }
+        """
+
+        changed, removed = diffAssignments(oldAssignments, newAssignments)
+        if changed:
+            for delegatorGUID, (readDelegateGUID, writeDelegateGUID) in changed:
+                readDelegateGroupID = writeDelegateGroupID  = None
+                if readDelegateGUID:
+                    readDelegateGroupID, name, hash = (
+                        yield txn.groupByGUID(readDelegateGUID)
+                    )
+                if writeDelegateGUID:
+                    writeDelegateGroupID, name, hash = (
+                        yield txn.groupByGUID(writeDelegateGUID)
+                    )
+                yield txn.assignExternalDelegates(
+                    delegatorGUID, readDelegateGroupID, writeDelegateGroupID,
+                    readDelegateGUID, writeDelegateGUID
+                )
+        if removed:
+            for delegatorGUID in removed:
+                yield txn.assignExternalDelegates(
+                    delegatorGUID, None, None, None, None
+                )
+
+
+
+    @inlineCallbacks
+    def refreshGroup(self, txn, groupGUID):
+        # Does the work of a per-group refresh work item
+        # Faults in the flattened membership of a group, as GUIDs
+        # and updates the GROUP_MEMBERSHIP table
+        record = (yield self.directory.recordWithGUID(groupGUID))
+        membershipHashContent = hashlib.md5()
+        members = (yield expandedMembers(record))
+        members = list(members)
+        members.sort(cmp=lambda x, y: cmp(x.guid, y.guid))
+        for member in members:
+            membershipHashContent.update(str(member.guid))
+        membershipHash = membershipHashContent.hexdigest()
+        groupID, cachedName, cachedMembershipHash = (
+            yield txn.groupByGUID(groupGUID)
+        )
+
+        if cachedMembershipHash != membershipHash:
+            membershipChanged = True
+            self.log.debug("Group '{group}' changed", group=record.fullNames[0])
+        else:
+            membershipChanged = False
+
+        yield txn.updateGroup(groupGUID, record.fullNames[0], membershipHash)
+
+        if membershipChanged:
+            newMemberGUIDs = set()
+            for member in members:
+                newMemberGUIDs.add(member.guid)
+            yield self.synchronizeMembers(txn, groupID, newMemberGUIDs)
+
+        yield self.scheduleEventReconciliations(txn, groupID, groupGUID)
+
+
+    @inlineCallbacks
+    def synchronizeMembers(self, txn, groupID, newMemberGUIDs):
+        numRemoved = numAdded = 0
+        cachedMemberGUIDs = (yield txn.membersOfGroup(groupID))
+
+        for memberGUID in cachedMemberGUIDs:
+            if memberGUID not in newMemberGUIDs:
+                numRemoved += 1
+                yield txn.removeMemberFromGroup(memberGUID, groupID)
+
+        for memberGUID in newMemberGUIDs:
+            if memberGUID not in cachedMemberGUIDs:
+                numAdded += 1
+                yield txn.addMemberToGroup(memberGUID, groupID)
+
+        returnValue((numAdded, numRemoved))
+
+
+    @inlineCallbacks
+    def cachedMembers(self, txn, groupID):
+        """
+        The members of the given group as recorded in the db
+        """
+        members = set()
+        memberGUIDs = (yield txn.membersOfGroup(groupID))
+        for guid in memberGUIDs:
+            record = (yield self.directory.recordWithGUID(guid))
+            if record is not None:
+                members.add(record)
+        returnValue(members)
+
+
+    def cachedGroupsFor(self, txn, guid):
+        """
+        The IDs of the groups the guid is a member of
+        """
+        return txn.groupsFor(guid)
+
+
+    @inlineCallbacks
+    def scheduleEventReconciliations(self, txn, groupID, groupGUID):
+        """
+        Find all events who have this groupID as an attendee and create
+        work items for them.
+        """
+        groupAttendee = schema.GROUP_ATTENDEE
+        rows = yield Select(
+            [groupAttendee.RESOURCE_ID, ],
+            From=groupAttendee,
+            Where=groupAttendee.GROUP_ID == groupID,
+        ).on(txn)
+        eventIDs = [row[0] for row in rows]
+
+        for eventID in eventIDs:
+
+            notBefore = (
+                datetime.datetime.utcnow() +
+                datetime.timedelta(seconds=10)
+            )
+            log.debug(
+                "scheduling group reconciliation for ({eventID}, {groupID}, {groupGUID}): {when}",
+                eventID=eventID,
+                groupID=groupID,
+                groupGUID=groupGUID,
+                when=notBefore)
+
+            yield txn.enqueue(
+                GroupAttendeeReconciliationWork,
+                eventID=eventID,
+                groupID=groupID,
+                groupGUID=groupGUID,
+                notBefore=notBefore
+            )
+
+
+    @inlineCallbacks
+    def groupsToRefresh(self, txn):
+        delegatedGUIDs = set((yield allGroupDelegates(txn)))
+        self.log.info("There are %d group delegates" % (len(delegatedGUIDs),))
+
+        attendeeGroupGUIDs = set()
+
+        # get all groups from events
+        groupAttendee = schema.GROUP_ATTENDEE
+        rows = yield Select(
+            [groupAttendee.GROUP_ID, ],
+            From=groupAttendee,
+        ).on(txn)
+        groupIDs = set([row[0] for row in rows])
+
+        # get groupGUIDs
+        if groupIDs:
+            gr = schema.GROUPS
+            rows = yield Select(
+                [gr.GROUP_GUID, ],
+                From=gr,
+                Where=gr.GROUP_ID.In(groupIDs)
+            ).on(txn)
+            attendeeGroupGUIDs = set([row[0] for row in rows])
+
+        returnValue(delegatedGUIDs.union(attendeeGroupGUIDs))

Added: CalendarServer/trunk/txdav/who/test/accounts/accounts.xml
===================================================================
--- CalendarServer/trunk/txdav/who/test/accounts/accounts.xml	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/test/accounts/accounts.xml	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+Copyright (c) 2006-2013 Apple Inc. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+ -->
+
+<!DOCTYPE accounts SYSTEM "accounts.dtd">
+
+<accounts realm="Test Realm">
+  <user>
+    <uid>admin</uid>
+    <guid>admin</guid>
+    <password>admin</password>
+    <name>Super User</name>
+    <first-name>Super</first-name>
+    <last-name>User</last-name>
+  </user>
+  <user>
+    <uid>apprentice</uid>
+    <guid>apprentice</guid>
+    <password>apprentice</password>
+    <name>Apprentice Super User</name>
+    <first-name>Apprentice</first-name>
+    <last-name>Super User</last-name>
+  </user>
+  <user>
+    <uid>wsanchez</uid>
+    <guid>wsanchez</guid>
+    <email-address>wsanchez at example.com</email-address>
+    <password>test</password>
+    <name>Wilfredo Sanchez Vega</name>
+    <first-name>Wilfredo</first-name>
+    <last-name>Sanchez Vega</last-name>
+  </user>
+  <user>
+    <uid>cdaboo</uid>
+    <guid>cdaboo</guid>
+    <email-address>cdaboo at example.com</email-address>
+    <password>test</password>
+    <name>Cyrus Daboo</name>
+    <first-name>Cyrus</first-name>
+    <last-name>Daboo</last-name>
+  </user>
+  <user>
+    <uid>sagen</uid>
+    <guid>sagen</guid>
+    <email-address>sagen at example.com</email-address>
+    <password>test</password>
+    <name>Morgen Sagen</name>
+    <first-name>Morgen</first-name>
+    <last-name>Sagen</last-name>
+  </user>
+  <user>
+    <uid>dre</uid>
+    <guid>andre</guid>
+    <email-address>dre at example.com</email-address>
+    <password>test</password>
+    <name>Andre LaBranche</name>
+    <first-name>Andre</first-name>
+    <last-name>LaBranche</last-name>
+  </user>
+  <user>
+    <uid>glyph</uid>
+    <guid>glyph</guid>
+    <email-address>glyph at example.com</email-address>
+    <password>test</password>
+    <name>Glyph Lefkowitz</name>
+    <first-name>Glyph</first-name>
+    <last-name>Lefkowitz</last-name>
+  </user>
+  <user>
+    <uid>i18nuser</uid>
+    <guid>i18nuser</guid>
+    <email-address>i18nuser at example.com</email-address>
+    <password>i18nuser</password>
+    <name>まだ</name>
+    <first-name>ま</first-name>
+    <last-name>だ</last-name>
+  </user>
+  <user repeat="101">
+    <uid>user%02d</uid>
+    <uid>User %02d</uid>
+    <guid>user%02d</guid>
+    <password>user%02d</password>
+    <name>User %02d</name>
+    <first-name>User</first-name>
+    <last-name>%02d</last-name>
+    <email-address>user%02d at example.com</email-address>
+  </user>
+  <user repeat="10">
+    <uid>public%02d</uid>
+    <guid>public%02d</guid>
+    <password>public%02d</password>
+    <name>Public %02d</name>
+    <first-name>Public</first-name>
+    <last-name>%02d</last-name>
+  </user>
+  <group>
+    <uid>group01</uid>
+    <guid>group01</guid>
+    <password>group01</password>
+    <name>Group 01</name>
+    <email-address>group01 at example.com</email-address>
+    <members>
+      <member type="users">user01</member>
+    </members>
+  </group>
+  <group>
+    <uid>group02</uid>
+    <guid>group02</guid>
+    <password>group02</password>
+    <name>Group 02</name>
+    <email-address>group02 at example.com</email-address>
+    <members>
+      <member type="users">user06</member>
+      <member type="users">user07</member>
+    </members>
+  </group>
+  <group>
+    <uid>group03</uid>
+    <guid>group03</guid>
+    <password>group03</password>
+    <name>Group 03</name>
+    <members>
+      <member type="users">user08</member>
+      <member type="users">user09</member>
+    </members>
+  </group>
+  <group>
+    <uid>group04</uid>
+    <guid>group04</guid>
+    <password>group04</password>
+    <name>Group 04</name>
+    <members>
+      <member type="groups">group02</member>
+      <member type="groups">group03</member>
+      <member type="users">user10</member>
+    </members>
+  </group>
+  <group> <!-- delegategroup -->
+    <uid>group05</uid>
+    <guid>group05</guid>
+    <password>group05</password>
+    <name>Group 05</name>
+    <members>
+      <member type="groups">group06</member>
+      <member type="users">user20</member>
+    </members>
+  </group>
+  <group> <!-- delegatesubgroup -->
+    <uid>group06</uid>
+    <guid>group06</guid>
+    <password>group06</password>
+    <name>Group 06</name>
+    <members>
+      <member type="users">user21</member>
+    </members>
+  </group>
+  <group> <!-- readonlydelegategroup -->
+    <uid>group07</uid>
+    <guid>group07</guid>
+    <password>group07</password>
+    <name>Group 07</name>
+    <members>
+      <member type="users">user22</member>
+      <member type="users">user23</member>
+      <member type="users">user24</member>
+    </members>
+  </group>
+  <group>
+    <uid>disabledgroup</uid>
+    <guid>disabledgroup</guid>
+    <password>disabledgroup</password>
+    <name>Disabled Group</name>
+    <members>
+      <member type="users">user01</member>
+    </members>
+  </group>
+</accounts>

Added: CalendarServer/trunk/txdav/who/test/accounts/resources.xml
===================================================================
--- CalendarServer/trunk/txdav/who/test/accounts/resources.xml	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/test/accounts/resources.xml	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+Copyright (c) 2006-2013 Apple Inc. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+ -->
+
+<!DOCTYPE accounts SYSTEM "accounts.dtd">
+
+<accounts realm="Test Realm">
+  <location repeat="10">
+    <uid>location%02d</uid>
+    <guid>location%02d</guid>
+    <password>location%02d</password>
+    <name>Room %02d</name>
+  </location>
+  <resource repeat="10">
+    <uid>resource%02d</uid>
+    <guid>resource%02d</guid>
+    <password>resource%02d</password>
+    <name>Resource %02d</name>
+  </resource>
+</accounts>

Added: CalendarServer/trunk/txdav/who/test/test_delegates.py
===================================================================
--- CalendarServer/trunk/txdav/who/test/test_delegates.py	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/test/test_delegates.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,239 @@
+##
+# Copyright (c) 2013 Apple Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##
+
+"""
+Delegates implementation tests
+"""
+
+from txdav.who.delegates import (
+    addDelegate, removeDelegate, delegatesOf, delegatedTo, allGroupDelegates
+)
+from txdav.who.groups import GroupCacher
+from twext.who.idirectory import RecordType
+from twext.who.test.test_xml import xmlService
+from twisted.internet.defer import inlineCallbacks
+from twistedcaldav.test.util import StoreTestCase
+from uuid import UUID
+
+
+class DelegationTest(StoreTestCase):
+
+    @inlineCallbacks
+    def setUp(self):
+        yield super(DelegationTest, self).setUp()
+        self.xmlService = xmlService(self.mktemp(), xmlData=testXMLConfig)
+        self.groupCacher = GroupCacher(self.xmlService)
+
+
+    @inlineCallbacks
+    def test_directDelegation(self):
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        delegator = yield self.xmlService.recordWithUID(u"__wsanchez__")
+        delegate1 = yield self.xmlService.recordWithUID(u"__sagen__")
+        delegate2 = yield self.xmlService.recordWithUID(u"__cdaboo__")
+
+        # Add 1 delegate
+        yield addDelegate(txn, delegator, delegate1, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(["sagen"], [d.shortNames[0] for d in delegates])
+        delegators = (yield delegatedTo(txn, delegate1, True))
+        self.assertEquals(["wsanchez"], [d.shortNames[0] for d in delegators])
+
+        # Add another delegate
+        yield addDelegate(txn, delegator, delegate2, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen", "cdaboo"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+        delegators = (yield delegatedTo(txn, delegate2, True))
+        self.assertEquals(["wsanchez"], [d.shortNames[0] for d in delegators])
+
+        # Remove 1 delegate
+        yield removeDelegate(txn, delegator, delegate1, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(["cdaboo"], [d.shortNames[0] for d in delegates])
+        delegators = (yield delegatedTo(txn, delegate1, True))
+        self.assertEquals(0, len(delegators))
+
+        # Remove the other delegate
+        yield removeDelegate(txn, delegator, delegate2, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(0, len(delegates))
+        delegators = (yield delegatedTo(txn, delegate2, True))
+        self.assertEquals(0, len(delegators))
+
+
+    @inlineCallbacks
+    def test_indirectDelegation(self):
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        delegator = yield self.xmlService.recordWithUID(u"__wsanchez__")
+        delegate1 = yield self.xmlService.recordWithUID(u"__sagen__")
+        group1 = yield self.xmlService.recordWithUID(u"__top_group_1__")
+        group2 = yield self.xmlService.recordWithUID(u"__sub_group_1__")
+
+        # Add group delegate, but before the group membership has been
+        # pulled in
+        yield addDelegate(txn, delegator, group1, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(0, len(delegates))
+
+        # Now refresh the group and there will be 3 delegates (contained
+        # within 2 nested groups)
+        # guid = "49b350c69611477b94d95516b13856ab"
+        yield self.groupCacher.refreshGroup(txn, group1.guid)
+        yield self.groupCacher.refreshGroup(txn, group2.guid)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen", "cdaboo", "glyph"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+        delegators = (yield delegatedTo(txn, delegate1, True))
+        self.assertEquals(["wsanchez"], [d.shortNames[0] for d in delegators])
+
+        # Verify we can ask for all delegated-to groups
+        yield addDelegate(txn, delegator, group2, True)
+        groups = (yield allGroupDelegates(txn))
+        self.assertEquals(
+            set([
+                UUID("49b350c69611477b94d95516b13856ab"),
+                UUID("86144f73345a409782f1b782672087c7")
+                ]), set(groups))
+
+        # Delegate to a user who is already indirectly delegated-to
+        yield addDelegate(txn, delegator, delegate1, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen", "cdaboo", "glyph"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+
+        # Add a member to the group; they become a delegate
+        newSet = set()
+        for name in (u"wsanchez", u"cdaboo", u"sagen", u"glyph", u"dre"):
+            record = (
+                yield self.xmlService.recordWithShortName(RecordType.user, name)
+            )
+            newSet.add(record.guid)
+        groupID, name, membershipHash = (yield txn.groupByGUID(group1.guid))
+        numAdded, numRemoved = (
+            yield self.groupCacher.synchronizeMembers(txn, groupID, newSet)
+        )
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen", "cdaboo", "glyph", "dre"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+
+        # Remove delegate access from the top group
+        yield removeDelegate(txn, delegator, group1, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen", "cdaboo"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+
+        # Remove delegate access from the sub group
+        yield removeDelegate(txn, delegator, group2, True)
+        delegates = (yield delegatesOf(txn, delegator, True))
+        self.assertEquals(
+            set(["sagen"]),
+            set([d.shortNames[0] for d in delegates])
+        )
+
+
+
+testXMLConfig = """<?xml version="1.0" encoding="utf-8"?>
+
+<directory realm="xyzzy">
+
+  <record type="user">
+    <uid>__wsanchez__</uid>
+    <guid>3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F</guid>
+    <short-name>wsanchez</short-name>
+    <short-name>wilfredo_sanchez</short-name>
+    <full-name>Wilfredo Sanchez</full-name>
+    <password>zehcnasw</password>
+    <email>wsanchez at bitbucket.calendarserver.org</email>
+    <email>wsanchez at devnull.twistedmatrix.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__glyph__</uid>
+    <guid>9064DF91-1DBC-4E07-9C2B-6839B0953876</guid>
+    <short-name>glyph</short-name>
+    <full-name>Glyph Lefkowitz</full-name>
+    <password>hpylg</password>
+    <email>glyph at bitbucket.calendarserver.org</email>
+    <email>glyph at devnull.twistedmatrix.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__sagen__</uid>
+    <guid>4AD155CB-AE9B-475F-986C-E08A7537893E</guid>
+    <short-name>sagen</short-name>
+    <full-name>Morgen Sagen</full-name>
+    <password>negas</password>
+    <email>sagen at bitbucket.calendarserver.org</email>
+    <email>shared at example.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__cdaboo__</uid>
+    <guid>7D45CB10-479E-456B-B54D-528958C5734B</guid>
+    <short-name>cdaboo</short-name>
+    <full-name>Cyrus Daboo</full-name>
+    <password>suryc</password>
+    <email>cdaboo at bitbucket.calendarserver.org</email>
+  </record>
+
+  <record type="user">
+    <uid>__dre__</uid>
+    <guid>CFC88493-DBFF-42B9-ADC7-9B3DA0B0769B</guid>
+    <short-name>dre</short-name>
+    <full-name>Andre LaBranche</full-name>
+    <password>erd</password>
+    <email>dre at bitbucket.calendarserver.org</email>
+    <email>shared at example.com</email>
+  </record>
+
+  <record type="group">
+    <uid>__top_group_1__</uid>
+    <guid>49B350C6-9611-477B-94D9-5516B13856AB</guid>
+    <short-name>top-group-1</short-name>
+    <full-name>Top Group 1</full-name>
+    <email>topgroup1 at example.com</email>
+    <member-uid>__wsanchez__</member-uid>
+    <member-uid>__glyph__</member-uid>
+    <member-uid>__sub_group_1__</member-uid>
+  </record>
+
+  <record type="group">
+    <uid>__sub_group_1__</uid>
+    <guid>86144F73-345A-4097-82F1-B782672087C7</guid>
+    <short-name>sub-group-1</short-name>
+    <full-name>Sub Group 1</full-name>
+    <email>subgroup1 at example.com</email>
+    <member-uid>__sagen__</member-uid>
+    <member-uid>__cdaboo__</member-uid>
+  </record>
+
+</directory>
+"""

Added: CalendarServer/trunk/txdav/who/test/test_groups.py
===================================================================
--- CalendarServer/trunk/txdav/who/test/test_groups.py	                        (rev 0)
+++ CalendarServer/trunk/txdav/who/test/test_groups.py	2014-02-12 00:30:58 UTC (rev 12663)
@@ -0,0 +1,497 @@
+##
+# Copyright (c) 2013 Apple Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##
+
+"""
+Group membership caching implementation tests
+"""
+
+from txdav.who.groups import GroupCacher, expandedMembers, diffAssignments
+from twext.who.idirectory import RecordType
+from twext.who.test.test_xml import xmlService
+from twisted.internet.defer import inlineCallbacks
+from twistedcaldav.test.util import StoreTestCase
+from txdav.common.icommondatastore import NotFoundError
+from uuid import UUID
+
+
+class GroupCacherTest(StoreTestCase):
+
+    @inlineCallbacks
+    def setUp(self):
+        yield super(GroupCacherTest, self).setUp()
+        self.xmlService = xmlService(self.mktemp(), xmlData=testXMLConfig)
+        self.groupCacher = GroupCacher(self.xmlService)
+
+
+    @inlineCallbacks
+    def test_expandedMembers(self):
+        """
+        Verify expandedMembers() returns a "flattened" set of records
+        belonging to a group (and does not return sub-groups themselves,
+        only their members)
+        """
+        record = yield self.xmlService.recordWithUID(u"__top_group_1__")
+        memberUIDs = set()
+        for member in (yield expandedMembers(record)):
+            memberUIDs.add(member.uid)
+        self.assertEquals(
+            memberUIDs,
+            set(["__cdaboo__", "__glyph__", "__sagen__", "__wsanchez__"])
+        )
+
+        # Non group records return an empty set() of members
+        record = yield self.xmlService.recordWithUID(u"__sagen__")
+        members = yield expandedMembers(record)
+        self.assertEquals(0, len(list(members)))
+
+
+    @inlineCallbacks
+    def test_refreshGroup(self):
+        """
+        Verify refreshGroup() adds a group to the Groups table with the
+        expected membership hash value and members
+        """
+
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        record = yield self.xmlService.recordWithUID(u"__top_group_1__")
+        yield self.groupCacher.refreshGroup(txn, record.guid)
+
+        groupID, name, membershipHash = (yield txn.groupByGUID(record.guid))
+        self.assertEquals(membershipHash, "4b0e162f2937f0f3daa6d10e5a6a6c33")
+
+        groupGUID, name, membershipHash = (yield txn.groupByID(groupID))
+        self.assertEquals(groupGUID, record.guid)
+        self.assertEquals(name, "Top Group 1")
+        self.assertEquals(membershipHash, "4b0e162f2937f0f3daa6d10e5a6a6c33")
+
+        members = (yield txn.membersOfGroup(groupID))
+        self.assertEquals(
+            set([UUID("9064df911dbc4e079c2b6839b0953876"),
+                 UUID("4ad155cbae9b475f986ce08a7537893e"),
+                 UUID("3bdcb95484d54f6d8035eac19a6d6e1f"),
+                 UUID("7d45cb10479e456bb54d528958c5734b")]),
+            members
+        )
+
+        records = (yield self.groupCacher.cachedMembers(txn, groupID))
+        self.assertEquals(
+            set([r.shortNames[0] for r in records]),
+            set(["wsanchez", "cdaboo", "glyph", "sagen"])
+        )
+
+        # sagen is in the top group, even though it's actually one level
+        # removed
+        record = yield self.xmlService.recordWithUID(u"__sagen__")
+        groups = (yield self.groupCacher.cachedGroupsFor(txn, record.guid))
+        self.assertEquals(set([groupID]), groups)
+
+
+    @inlineCallbacks
+    def test_synchronizeMembers(self):
+        """
+        After loading in a group via refreshGroup(), pass new member sets to
+        synchronizeMembers() and verify members are added and removed as
+        expected
+        """
+
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        # Refresh the group so it's assigned a group_id
+        guid = UUID("49b350c69611477b94d95516b13856ab")
+        yield self.groupCacher.refreshGroup(txn, guid)
+        groupID, name, membershipHash = (yield txn.groupByGUID(guid))
+
+        # Remove two members, and add one member
+        newSet = set()
+        for name in (u"wsanchez", u"cdaboo", u"dre"):
+            record = (
+                yield self.xmlService.recordWithShortName(
+                    RecordType.user,
+                    name
+                )
+            )
+            newSet.add(record.guid)
+        numAdded, numRemoved = (
+            yield self.groupCacher.synchronizeMembers(
+                txn, groupID, newSet
+            )
+        )
+        self.assertEquals(numAdded, 1)
+        self.assertEquals(numRemoved, 2)
+        records = (yield self.groupCacher.cachedMembers(txn, groupID))
+        self.assertEquals(
+            set([r.shortNames[0] for r in records]),
+            set(["wsanchez", "cdaboo", "dre"])
+        )
+
+        # Remove all members
+        numAdded, numRemoved = (
+            yield self.groupCacher.synchronizeMembers(txn, groupID, set())
+        )
+        self.assertEquals(numAdded, 0)
+        self.assertEquals(numRemoved, 3)
+        records = (yield self.groupCacher.cachedMembers(txn, groupID))
+        self.assertEquals(len(records), 0)
+
+
+    @inlineCallbacks
+    def test_groupByID(self):
+
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        # Non-existent groupID
+        self.failUnlessFailure(txn.groupByID(42), NotFoundError)
+
+        guid = UUID("49b350c69611477b94d95516b13856ab")
+        hash = "4b0e162f2937f0f3daa6d10e5a6a6c33"
+        yield self.groupCacher.refreshGroup(txn, guid)
+        groupID, name, membershipHash = (yield txn.groupByGUID(guid))
+        results = (yield txn.groupByID(groupID))
+        self.assertEquals([guid, "Top Group 1", hash], results)
+
+
+    @inlineCallbacks
+    def test_externalAssignments(self):
+
+        store = self.storeUnderTest()
+        txn = store.newTransaction()
+
+        oldExternalAssignments = (yield txn.externalDelegates())
+        self.assertEquals(oldExternalAssignments, {})
+
+        newAssignments = {
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"):
+            (None, UUID("49B350C6-9611-477B-94D9-5516B13856AB"))
+        }
+        yield self.groupCacher.applyExternalAssignments(txn, newAssignments)
+        oldExternalAssignments = (yield txn.externalDelegates())
+        self.assertEquals(
+            oldExternalAssignments,
+            {
+                UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"):
+                (
+                    None,
+                    UUID("49B350C6-9611-477B-94D9-5516B13856AB")
+                )
+            }
+        )
+
+        newAssignments = {
+            UUID("7D45CB10-479E-456B-B54D-528958C5734B"):
+            (
+                UUID("86144F73-345A-4097-82F1-B782672087C7"),
+                None
+            ),
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"):
+            (
+                UUID("86144F73-345A-4097-82F1-B782672087C7"),
+                UUID("49B350C6-9611-477B-94D9-5516B13856AB")
+            ),
+        }
+        yield self.groupCacher.applyExternalAssignments(txn, newAssignments)
+        oldExternalAssignments = (yield txn.externalDelegates())
+        self.assertEquals(
+            oldExternalAssignments,
+            {
+                UUID('3bdcb954-84d5-4f6d-8035-eac19a6d6e1f'):
+                (
+                    UUID('86144f73-345a-4097-82f1-b782672087c7'),
+                    UUID('49b350c6-9611-477b-94d9-5516b13856ab')
+                ),
+                UUID('7d45cb10-479e-456b-b54d-528958c5734b'):
+                (
+                    UUID('86144f73-345a-4097-82f1-b782672087c7'),
+                    None
+                )
+            }
+        )
+
+        allGroupDelegates = (yield txn.allGroupDelegates())
+        self.assertEquals(
+            allGroupDelegates,
+            set(
+                [
+                    UUID('49b350c6-9611-477b-94d9-5516b13856ab'),
+                    UUID('86144f73-345a-4097-82f1-b782672087c7')
+                ]
+            )
+        )
+
+        # Fault in the read-only group
+        yield self.groupCacher.refreshGroup(txn, UUID('86144f73-345a-4097-82f1-b782672087c7'))
+
+        # Wilfredo should have Sagen and Daboo as read-only delegates
+        delegates = (yield txn.delegates(
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"), False)
+        )
+        self.assertEquals(
+            delegates,
+            set(
+                [
+                    UUID('4ad155cb-ae9b-475f-986c-e08a7537893e'),
+                    UUID('7d45cb10-479e-456b-b54d-528958c5734b')
+                ]
+            )
+        )
+
+        # Fault in the read-write group
+        yield self.groupCacher.refreshGroup(txn, UUID('49b350c6-9611-477b-94d9-5516b13856ab'))
+
+        # Wilfredo should have 4 users as read-write delegates
+        delegates = (yield txn.delegates(
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"), True)
+        )
+        self.assertEquals(
+            delegates,
+            set(
+                [
+                    UUID('3bdcb954-84d5-4f6d-8035-eac19a6d6e1f'),
+                    UUID('4ad155cb-ae9b-475f-986c-e08a7537893e'),
+                    UUID('7d45cb10-479e-456b-b54d-528958c5734b'),
+                    UUID('9064df91-1dbc-4e07-9c2b-6839b0953876')
+                ]
+            )
+        )
+
+
+        #
+        # Now, remove some external assignments
+        #
+        newAssignments = {
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"):
+            (
+                UUID("86144F73-345A-4097-82F1-B782672087C7"),
+                None
+            ),
+        }
+        yield self.groupCacher.applyExternalAssignments(txn, newAssignments)
+        oldExternalAssignments = (yield txn.externalDelegates())
+        self.assertEquals(
+            oldExternalAssignments,
+            {
+                UUID('3bdcb954-84d5-4f6d-8035-eac19a6d6e1f'):
+                (
+                    UUID('86144f73-345a-4097-82f1-b782672087c7'),
+                    None
+                ),
+            }
+        )
+
+        allGroupDelegates = (yield txn.allGroupDelegates())
+        self.assertEquals(
+            allGroupDelegates,
+            set(
+                [
+                    UUID('86144f73-345a-4097-82f1-b782672087c7')
+                ]
+            )
+        )
+
+        # Wilfredo should have Sagen and Daboo as read-only delegates
+        delegates = (yield txn.delegates(
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"), False)
+        )
+        self.assertEquals(
+            delegates,
+            set(
+                [
+                    UUID('4ad155cb-ae9b-475f-986c-e08a7537893e'),
+                    UUID('7d45cb10-479e-456b-b54d-528958c5734b')
+                ]
+            )
+        )
+
+        # Wilfredo should have no read-write delegates
+        delegates = (yield txn.delegates(
+            UUID("3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F"), True)
+        )
+        self.assertEquals(
+            delegates,
+            set([])
+        )
+
+        # Only 1 group as delegate now:
+        allGroupDelegates = (yield txn.allGroupDelegates())
+        self.assertEquals(
+            allGroupDelegates,
+            set(
+                [
+                    UUID('86144f73-345a-4097-82f1-b782672087c7')
+                ]
+            )
+        )
+
+    def test_diffAssignments(self):
+        """
+        Ensure external proxy assignment diffing works
+        """
+
+        self.assertEquals(
+            (
+                # changed
+                [],
+                # removed
+                [],
+            ),
+            diffAssignments(
+                # old
+                {},
+                # new
+                {}
+            )
+        )
+
+        self.assertEquals(
+            (
+                # changed
+                [],
+                # removed
+                [],
+            ),
+            diffAssignments(
+                # old
+                {"B": ("1", "2")},
+                # new
+                {"B": ("1", "2")},
+            )
+        )
+
+        self.assertEquals(
+            (
+                # changed
+                [("A", ("1", "2")), ("B", ("3", "4"))],
+                # removed
+                [],
+            ),
+            diffAssignments(
+                # old
+                {},
+                # new
+                {"A": ("1", "2"), "B": ("3", "4")}
+            )
+        )
+
+        self.assertEquals(
+            (
+                # changed
+                [],
+                # removed
+                ["A", "B"],
+            ),
+            diffAssignments(
+                # old
+                {"A": ("1", "2"), "B": ("3", "4")},
+                # new
+                {},
+            )
+        )
+
+        self.assertEquals(
+            (
+                # changed
+                [('C', ('4', '5')), ('D', ('7', '8'))],
+                # removed
+                ["B"],
+            ),
+            diffAssignments(
+                # old
+                {"A": ("1", "2"), "B": ("3", "4"), "C": ("5", "6")},
+                # new
+                {"D": ("7", "8"), "C": ("4", "5"), "A": ("1", "2")},
+            )
+        )
+
+testXMLConfig = """<?xml version="1.0" encoding="utf-8"?>
+
+<directory realm="xyzzy">
+
+  <record type="user">
+    <uid>__wsanchez__</uid>
+    <guid>3BDCB954-84D5-4F6D-8035-EAC19A6D6E1F</guid>
+    <short-name>wsanchez</short-name>
+    <short-name>wilfredo_sanchez</short-name>
+    <full-name>Wilfredo Sanchez</full-name>
+    <password>zehcnasw</password>
+    <email>wsanchez at bitbucket.calendarserver.org</email>
+    <email>wsanchez at devnull.twistedmatrix.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__glyph__</uid>
+    <guid>9064DF91-1DBC-4E07-9C2B-6839B0953876</guid>
+    <short-name>glyph</short-name>
+    <full-name>Glyph Lefkowitz</full-name>
+    <password>hpylg</password>
+    <email>glyph at bitbucket.calendarserver.org</email>
+    <email>glyph at devnull.twistedmatrix.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__sagen__</uid>
+    <guid>4AD155CB-AE9B-475F-986C-E08A7537893E</guid>
+    <short-name>sagen</short-name>
+    <full-name>Morgen Sagen</full-name>
+    <password>negas</password>
+    <email>sagen at bitbucket.calendarserver.org</email>
+    <email>shared at example.com</email>
+  </record>
+
+  <record type="user">
+    <uid>__cdaboo__</uid>
+    <guid>7D45CB10-479E-456B-B54D-528958C5734B</guid>
+    <short-name>cdaboo</short-name>
+    <full-name>Cyrus Daboo</full-name>
+    <password>suryc</password>
+    <email>cdaboo at bitbucket.calendarserver.org</email>
+  </record>
+
+  <record type="user">
+    <uid>__dre__</uid>
+    <guid>CFC88493-DBFF-42B9-ADC7-9B3DA0B0769B</guid>
+    <short-name>dre</short-name>
+    <full-name>Andre LaBranche</full-name>
+    <password>erd</password>
+    <email>dre at bitbucket.calendarserver.org</email>
+    <email>shared at example.com</email>
+  </record>
+
+  <record type="group">
+    <uid>__top_group_1__</uid>
+    <guid>49B350C6-9611-477B-94D9-5516B13856AB</guid>
+    <short-name>top-group-1</short-name>
+    <full-name>Top Group 1</full-name>
+    <email>topgroup1 at example.com</email>
+    <member-uid>__wsanchez__</member-uid>
+    <member-uid>__glyph__</member-uid>
+    <member-uid>__sub_group_1__</member-uid>
+  </record>
+
+  <record type="group">
+    <uid>__sub_group_1__</uid>
+    <guid>86144F73-345A-4097-82F1-B782672087C7</guid>
+    <short-name>sub-group-1</short-name>
+    <full-name>Sub Group 1</full-name>
+    <email>subgroup1 at example.com</email>
+    <member-uid>__sagen__</member-uid>
+    <member-uid>__cdaboo__</member-uid>
+  </record>
+
+</directory>
+"""
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.macosforge.org/pipermail/calendarserver-changes/attachments/20140312/d19368b8/attachment.html>


More information about the calendarserver-changes mailing list