* feat: add ownCloud branding background to login screens
Ships the ownCloud branding image as the default IDP login background and
aligns the web and Keycloak login screens to match.
Reworked for the no-npm IDP (services/idp/src was removed by #12086): the
branding is applied directly in the committed bundle. The default background
image lives at services/idp/assets/identifier/static/media and is referenced
from theme.css, which now anchors it to the top right (background-position) so
the ownCloud logo stays fully visible at every viewport aspect ratio instead
of being cropped by center positioning. Operators can still override the image
via IDP_LOGIN_BACKGROUND_URL (unchanged on master).
Also embeds the same image in the web service theme assets and adds an
"owncloud" Keycloak login theme (already anchored top right) to the
ocis_keycloak deployment example.
Signed-off-by: David Walter <david.walter@kiteworks.com>
Signed-off-by: Lukas Hirt <info@hirt.cz>
* docs(deployment): title-case ocis_keycloak README headings
Co-authored-by: Martin <github@diemattels.at>
Signed-off-by: Lukas Hirt <info@hirt.cz>
---------
Signed-off-by: David Walter <david.walter@kiteworks.com>
Signed-off-by: Lukas Hirt <info@hirt.cz>
Co-authored-by: kobergj <jkoberg@owncloud.com>
Co-authored-by: Martin <github@diemattels.at>
* fix(deployments): support Collabora Online 26.x in ocis_full example
collabora/code 26.x dropped the shell (no /bin/bash, no /bin/sh) and the
coolconfig helper the ocis_full example relied on to start the container
and generate its WOPI proof key, so the deployment failed to start and,
once patched to start, would reject every document open with a 500 since
the collaboration service enforces WOPI proof-key verification by default.
Drop the custom bash entrypoint (the image's default entrypoint already
honors extra_params/username/password via --use-env-vars), replace the
bash-based healthcheck with the built-in "coolwsd --probe", and add a
one-shot init container that generates and persists the WOPI proof key
on the host before Collabora starts.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix(deployments): self-heal a bad WOPI proof key in ocis_full example
The collabora-proof-key-init container only checked "does /keys/proof_key
exist" before skipping generation. If the collabora service's single-file
bind mount of that path ever won the race against the init container (e.g.
on the very first `docker compose up`, or after an interrupted run), Docker
silently created a directory there instead of a file, which then persisted
across restarts and made coolwsd fail to load the proof key with an
EVPPKey::loadKey DECODER error, breaking WOPI CheckFileInfo for good.
Validate any existing proof_key with `openssl rsa -check` and remove it
before regenerating if it's missing, not a regular file, or invalid, so a
bad state (directory, truncated write, corrupt key) heals itself on the
next start instead of requiring a manual `rm -rf` of the generated config.
Signed-off-by: Lukas Hirt <info@hirt.cz>
---------
Signed-off-by: Lukas Hirt <info@hirt.cz>
* feat(invitations): configurable Keycloak actions + working ocis_full SMTP
The invitations service already triggers Keycloak execute-actions-email after
provisioning a guest (service.Invite -> backend.SendMail ->
gocloak.ExecuteActionsEmail). Two things still limited it:
- The required actions were hardcoded to UPDATE_PASSWORD,VERIFY_EMAIL. They are
now configurable via INVITATIONS_KEYCLOAK_EXECUTE_ACTIONS (comma-separated,
same default). Unknown actions are logged and skipped, and the service falls
back to the defaults if none remain valid so a guest always has a setup path.
- The Keycloak realm shipped with the ocis_full example had an empty smtpServer,
so Keycloak silently dropped every mail it tried to send, including the guest
invitation mail. The realm now points SMTP at the bundled mailpit
(mailserver:1025).
Verified: execute-actions-email delivers to mailpit against the ocis_full realm;
go test ./services/invitations/... ./ocis-pkg/keycloak/... -race passes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* fix(invitations): return the created user as invitedUser in the response
service.Invite echoed the request body unchanged, leaving the invitedUser
relation of the Graph invitation response empty, so a client could not learn
the identity of the guest that was just created. The keycloak backend now
records the created user (OWNCLOUD_ID, email, user type) on the invitation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* refactor(invitations): pass Keycloak actions through verbatim (no allowlist)
Address review (@kobergj): the configured execute-actions no longer need to
match a hardcoded enum. UserAction is now a string type passed to Keycloak
as-is, so operators can configure any required action their Keycloak supports
without oCIS keeping a list in sync. The convenience constants remain, the
default (UPDATE_PASSWORD, VERIFY_EMAIL) is unchanged, and validation is left to
Keycloak. Removes UserActionFromString and the two lookup maps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
---------
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mount the named volume at /var/lib/postgresql instead of /var/lib/postgresql/data
to avoid initdb failures caused by lost+found directory on ext4 storage backends.
* chore: release 8.0.0-rc.1
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* [docs-only] Fix of storage-publiclink readme
* fix: some notifications were translated wrong due to an empty l10n key
The expected translatable message was empty, which caused the
translation system to use the empty key, which contains "weird"
unrelated data.
With the fix, if there is no translatable message, the related output
will remain empty.
* [docs-only][stable-8.0] Update web-extensions image versions in ocis_full
* feat: bump go to 1.25
feat: bump mockery to v2.53.5
feat: bump govulncheck
feat: bump bingo to v0.10.0
force go-1.25.7
update thumbnail images for test
* chore: bump web to v12.3.1
* fix: ocis-multi deployment example groups
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.0
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: add v8 to production versions
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: write to docs-stable branch
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* test: fix public link related test for k8s deployment
* chore(idp): use kpop without dependency
Instead of trying to download kpop every time, bring in the specific
code that we are using. There is very little code that we are actually
using from kpop so pulling it as a dependency is not really necessary
and it should fix the current CI issues.
* fix: codacy deprecated reporter
* fix: post rebase cleanup
* chore(web): bump ownCloud Web to v12.3.2
* fix(graph): Don't use hardcoded groupOfNames in group creation
* fix(graph): (ai) fix other groupOfNames and comment
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* test: let (ai) add a test for it
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: adjust ocis-multi example
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* docs: update changelog item
Co-authored-by: Martin <github@diemattels.at>
* fix:[OCISDEV-617] Expose the signature-auth attribute
* ci: use plugins/s3:1.4.0
* fix: dont write externalID when empty
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* feat: add globalID for EK users
* fix: bump reva version
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.1
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* [backport] feat: [OCISDEV-732] acceptance test (#12143) to stable-8.0.0 (#12236)
* feat: [OCISDEV-732] acceptance test (#12143)
* feat: acceptance test - graph
* feat: acceptance test - graph
* feat: acceptance test - graph
* fix: remove drone
* feat: run each behat suite as a separate worker
* feat: rename
feat: [OCISDEV-740] acceptance test, coverage P0
feat: [OCISDEV-743] build and unit test
ci: [ocisdev-730] code quality
feat: [OCISDEV-741] local-api-test part 2
feat: [OCISDEV-741] local-api-test, apiSpaces
feat: [OCISDEV-744] cli-test
feat: [OCISDEV-741] local-api-test, apiCollaboration
# Conflicts:
# .github/workflows/acceptance-tests.yml
# tests/acceptance/run-github.py
feat: [OCISDEV-741] integration
feat: [OCISDEV-744] build-and-test, lint
feat: [OCISDEV-744] e2e-test
# Conflicts:
# .github/workflows/acceptance-tests.yml
feat: [OCISDEV-744] fix apiSearch2 test suite
* test [OCISDEV-744]: Run apiSearch2 test suite
* Added php8.4-gd to all 4 PHP install lines
* test [OCISDEV-744]: Enable all commented tests
* test [OCISDEV-744]: Fixed failings
* test [OCISDEV-744]: Fixed failings
feat: [OCISDEV-744] fix apiOcm test suite
* test [OCISDEV-744]: fix apiOcm tests
* test [OCISDEV-744]: remove redundant .sh files
* test [OCISDEV-744]: remove run-e2e.sh. Fix DRY vialation in run-github.py
* test [OCISDEV-744]: documentation fixes
---------
Co-authored-by: Deyan Zhekov <deyan.zhekov@kiteworks.com>
fix: [OCISDEV-730] actions compliance (#12187)
feat: [OCISDEV-786] Split coreApiSharees and coreApiSharePublicLink2 (#12196)
feat: [OCISDEV-779] reduce ci duration, libcurl (#12193)
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
feat: [OCISDEV-792] reduce ci duration, build-and-run (#12204)
* feat: [OCISDEV-792] reduce ci duration, build-and-run
* feat: [OCISDEV-792] reduce ci duration, build-and-run
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
fix: ci, govulncheck stderr (#12219)
* fix: ci, govulncheck stderr
* fix: ci, litmus flakines
feat: [OCISDEV-779] reduce CI duration, PHP-version (#12217)
* feat: [OCISDEV-779] reduce CI duration, php-version
* feat: [OCISDEV-779] fix flaky test in apiSharingNgShares
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] replace manual PHP installation with shivammathur/setup-php action
* feat: [OCISDEV-779] fix Pre-checks and generate step
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] fix failing test
---------
Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
* feat: post rebase fix
* feat: post rebase fix
* feat: post rebase fix
* feat: [OCISDEV-783] release pipeline (#12194) (#12235)
* feat: Add basic GH Actions file
* feat: [OCISDEV-783] release pipeline
* feat: [OCISDEV-783] release pipeline
* feat: [OCISDEV-783] release pipeline, DeepDiver's review comments
* feat: [OCISDEV-783] release pipeline, DeepDiver's review comments
* feat: [OCISDEV-783] release pipeline, assert release
* feat: [OCISDEV-783] release pipeline, audit release
* feat: [OCISDEV-783] release pipeline, bianaries
* feat: [OCISDEV-783] release pipeline, bianaries
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, trivy scan
* feat: [OCISDEV-783] release pipeline, gh actions
* trigger CI
* feat: [OCISDEV-783] release pipeline, align versions
* feat: [OCISDEV-783] release pipeline, scan message
* feat: [OCISDEV-783] release pipeline, ack alpine scan
* feat: [OCISDEV-783] release pipeline, align versions
* feat: [OCISDEV-783] release pipeline, review
* feat: [OCISDEV-783] release pipeline, review
* feat: [OCISDEV-783] release pipeline, trivy scan
---------
Co-authored-by: Lukas Schwarz <lukas.schwarz@kiteworks.com>
* feat(graph): [OCISDEV-794] allow multiple objectClasses on group creation
Add GroupAdditionalObjectClasses config field (env vars
OCIS_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES /
GRAPH_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES) that appends extra
objectClasses when creating groups in LDAP, alongside the existing
primary GroupObjectClass. Applied to both groupToLDAPAttrValues and
CreateLDAPGroupByDN.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* feat(webdav): [OCISDEV-602] add spaceid to report
Added the `spaceid` to the REPORT responses. This is aligning the
`REPORT` method with the `PROPFIND` method.
* build(deps): stable-8.0
* feat(graph): [OCISDEV-807] add SpaceEditorWithoutVersionsWithoutTrashbin role
Adds a new space membership role "Can edit" that allows creating, uploading,
downloading, editing, moving and deleting on a space without access to file
versions or the trashbin. Also bumps reva to include the corresponding role
constructor.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix(collaboration): [OCISDEV-781] return 200 OK for WOPI Lock in read-only modes
OnlyOffice sends a WOPI Lock request on document open regardless of whether
the user has write access. The Lock handler was calling SetLock with a
read-only CS3 token, which returned a permission error propagated as HTTP 500
to OnlyOffice, causing an error dialog on load.
Return 200 OK immediately for READ_ONLY and VIEW_ONLY view modes without
acquiring a CS3 lock.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: fixed the internal links access control
* use the web stable-12.3 latest
* fix the OCM share permission change notification handling
* [OCISDEV-830] Add GitHub Actions workflow for k6 load tests with flag [k6-test]
* [OCISDEV-827] Add workflow file to run k6-tests in GitHub Actions
* [OCISDEV-827] Fix broken pipeline job
* [OCISDEV-827] Fix broken pipeline job - switched to double quotes.
* [OCISDEV-827] Trying to fix a broken pipeline job
* [OCISDEV-827] Fix secrets and variables used to run k6-test
* [OCISDEV-827] Add health check and SSH keepalive in run_k6_tests.sh
* [OCISDEV-827] Rename variable DRONE_COMMIT to OCIS_COMMIT_SHA
* chore: bump web version to 12.3.3
* [OCISDEV-833] Added rm -rf k6-ocis via SSH before ocis.sh start (#12280)
* fix(proxy): [OCISDEV-845] skip space reconciliation on signed URL requests
The space management middleware removed users from all project spaces
when processing signed URL requests because no OIDC claims are present
in that auth context. Return early when claims are nil to prevent the
oscillating add/remove cycle.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore(proxy): [OCISDEV-845] add changelog for space manager fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.2
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: bump libvips (#12304)
* chore: bump go version (#12306)
* fix: [OCISDEV-864] CI, fix passing version string value to image (#12309) (#12319)
* fix: release fix passing version string value to image
* fix: bump release tag
* chore: bump go-git
* fix: missing fcntl64 int the build image due to GHA image update
* fix: [OCISDEV-865] CI, release pipeline steps ordering (#12310) (#12320)
* fix: ci, release pipeline steps ordering
* chore: security bump
* fix: ignore for trivy scan, steps order
# Conflicts:
# services/idp/package.json
# services/idp/pnpm-lock.yaml
* fix: [backport][OCISDEV-873] *WithoutTrashbin space editor roles render files read-only in Web frontend (#12351)
fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files read-only in Web frontend (#12346)
* fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files as read-only in Web frontend
* fix: ci after godata bump
ocis CI bumped github.com/CiscoM31/godata from v1.0.10 → v1.0.11 as a transitive dependency of the reva bump. The new godata version parses "mail add 10 (invalid operator) as a parse error → 400 instead of unsupported operation → 501.
* fix ci: more precise role
* fix: bump reva to pull fix merged into reva
* Release 8.0.4 (#12352)
chore: Release 8.0.4
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: dont write externalID when empty
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
---------
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Martin Mattel <github@diemattels.at>
Co-authored-by: Juan Pablo Villafáñez <jvillafanez@solidgeargroup.com>
Co-authored-by: Roman Perekhod <2403905@gmail.com>
Co-authored-by: Roman Perekhod <rperekhod@owncloud.com>
Co-authored-by: Matteo <matteo.sonnenholzner@kiteworks.com>
Co-authored-by: Niraj Acharya <niraj@jankaritech.com>
Co-authored-by: Lukas Hirt <info@hirt.cz>
Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
Co-authored-by: Gwilherm Folliot <gwilherm55fo@gmail.com>
Co-authored-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-authored-by: Lukas Schwarz <lukas.schwarz@kiteworks.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Deyan Zhekov <deyan.zhekov@kiteworks.com>
Co-authored-by: Matteo <193476828+mzner@users.noreply.github.com>
* feat: Implemet the vault-storage
feat: Separate the storage-users and graph to handle
feat: move the space create cache
configurate the vault srorage Postprocessing
hide the assignment of the MountID to VaultStorageProviderID behind a flag to avoid the ID mismatch
configurate the proxy to create the vault home space
update the filter
Make the graph able to handle vault prefix. no extra service needed
apply the vault filter to sharedbyme and sharedwithme
added vault-storage docker
use squashed reva
fix the finishUpload event
restict webdav copy/move from the vault
feat: provide the mfa to webdav and grpc
feat: refactoring: provide the mfa to webdav and grpc
mfa collaboration
fix GetRootDriveChildren and more
fix: send the MFA header in HTTP clients from the collaboration service
provide the default storage user vault configuration
update create_home middleware
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
Update services/gateway/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/proxy/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
bump reva
deduplicate the requireMFA middeware on vault routes. fix AppendPlainToOpaque.
added the changlog and comments
* feat: add the vault mode search
* Update changelog/unreleased/enhancement-vault-storage.md
Co-authored-by: Martin <github@diemattels.at>
* update the readme. the reva vault storage provider configuration disabled by default
* feat: [OCISDEV-531] add vault capabilities to the OCS capabilities endpoint
* the port range allocated. the configuration updated.
---------
Co-authored-by: Martin <github@diemattels.at>
Add GroupAdditionalObjectClasses config field (env vars
OCIS_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES /
GRAPH_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES) that appends extra
objectClasses when creating groups in LDAP, alongside the existing
primary GroupObjectClass. Applied to both groupToLDAPAttrValues and
CreateLDAPGroupByDN.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Update acceptance tests and all deployment example CSP configs to include
'data:' in font-src, consistent with the default csp.yaml change.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
