The next oCIS release is 9.0.0, so all envvars that were annotated with
the previously planned 8.3.0 introduction version need to be updated.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
The env var was tagged introductionVersion:"NEXT", a placeholder the docs
process rejects. The var was introduced by #12467 and is still unreleased;
master is on the 8.3.0 dev cycle, so pin it to 8.3.0.
* feat(invitations): configurable Keycloak actions + working ocis_full SMTP
The invitations service already triggers Keycloak execute-actions-email after
provisioning a guest (service.Invite -> backend.SendMail ->
gocloak.ExecuteActionsEmail). Two things still limited it:
- The required actions were hardcoded to UPDATE_PASSWORD,VERIFY_EMAIL. They are
now configurable via INVITATIONS_KEYCLOAK_EXECUTE_ACTIONS (comma-separated,
same default). Unknown actions are logged and skipped, and the service falls
back to the defaults if none remain valid so a guest always has a setup path.
- The Keycloak realm shipped with the ocis_full example had an empty smtpServer,
so Keycloak silently dropped every mail it tried to send, including the guest
invitation mail. The realm now points SMTP at the bundled mailpit
(mailserver:1025).
Verified: execute-actions-email delivers to mailpit against the ocis_full realm;
go test ./services/invitations/... ./ocis-pkg/keycloak/... -race passes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* fix(invitations): return the created user as invitedUser in the response
service.Invite echoed the request body unchanged, leaving the invitedUser
relation of the Graph invitation response empty, so a client could not learn
the identity of the guest that was just created. The keycloak backend now
records the created user (OWNCLOUD_ID, email, user type) on the invitation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* refactor(invitations): pass Keycloak actions through verbatim (no allowlist)
Address review (@kobergj): the configured execute-actions no longer need to
match a hardcoded enum. UserAction is now a string type passed to Keycloak
as-is, so operators can configure any required action their Keycloak supports
without oCIS keeping a list in sync. The convenience constants remain, the
default (UPDATE_PASSWORD, VERIFY_EMAIL) is unchanged, and validation is left to
Keycloak. Removes UserActionFromString and the two lookup maps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
---------
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
otelchi and other custom solutions have been replaced with otelhttp to
trace HTTP requests; new middleware is provided to be used across the
platform.
The proxy service will use a custom HTTP client to forward the headers
needed for telemetry automatically (also based on otelhttp)
* feat: add CSP and other security related headers in the oCIS proxy service
* fix: consolidate security related headers - drop middleware.Secure
* fix: use github.com/DeepDiver1975/secure
* fix: acceptance tests
* feat: support env var replacements in csp.yaml
* bump mockery, add test stub for oidc_auth.go
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* use .mockery.yaml for all mocks
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* drop legacy go:generate mockery
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* align mock placement
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
---------
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* enhancement: add graph beta listPermissions endpoint
besides the new api endpoint it includes several utilities to simplify the graph api development.
* resolve drive and item id from the request path
* generic pointer and value utilities
* space root detection
* update GetDriveAndItemIDParam signature to return a error
* move errorcode package
* enhancement: add generic error code handling
* fix: rebase
We were using stretchr/testify and test-go/testify inconsitently and
sometimes mixed in the same tests. This can cause very strange issue,
e.g when using things like mock.MatchedBy().
This moves all our code to stretchr/testify, which seems to be far
more active and maintained then test-go/testify.
