* fix: [OCISDEV-1523] fix the LDAP master-ID filter for an empty base filter
EnhanceFilterWithMasterID replaced an empty LDAP filter with a master-ID-only
filter. This action restricted an unrestricted search to master-ID users
only. The bug broke the cross-instance user search in multi-instance
deployments. The function now keeps an empty filter unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: [OCISDEV-1523] require an explicit LDAP user filter with a master ID
EnhanceFilterWithMasterID in ocis-pkg/ldap/filter.go now keeps an empty
LDAP filter unchanged instead of restricting it to master-ID users only.
The auth-basic, users, groups, and graph services reuse this function to
compute their default LDAP user filter at startup.
An unset filter now means these services resolve or authenticate every
user in the shared LDAP directory, not only master-ID users. This action
is a behavior change for a deployment that sets
OCIS_MULTI_INSTANCE_MASTER_ID without an explicit OCIS_LDAP_USER_FILTER.
Each service now rejects startup when OCIS_MULTI_INSTANCE_MASTER_ID is
set and its own user filter is empty. This action keeps a multi-instance
deployment scoped to its own users by default.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* refactor: [OCISDEV-1523] simplify EnhanceFilterWithMasterID guard clauses
The function collapses three early-return guards into one condition.
This action removes a duplicated rationale comment between filter.go
and filter_test.go.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* docs: [OCISDEV-1523] point the changelog entry at the master backport PR
The changelog entry pointed at PR 13096, the stable-8.2 backport. This
commit points the entry at the master-branch PR number instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The next oCIS release is 9.0.0, so all envvars that were annotated with
the previously planned 8.3.0 introduction version need to be updated.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
* chore: bump reva
* chore: bump pnpm dependencies
* fix: avoid go vet false positive in userlog conversion.go
The go.mod bump to go 1.26.8 made go vet flag loadTemplates' calls to
t.Get(nt.Subject/nt.Message) as non-constant format strings, breaking
the build for services/userlog/pkg/service. These are translation
lookup keys, not printf format strings, so route the call through a
local func value to defeat vet's static trace.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* chore: bump grpc
Fixes GO-2026-6443, a server panic when handling requests missing
authority or Host headers, flagged by govulncheck in CI.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Document that the *_TLS_INSECURE options for the nats-js-kv store, cache and
service registry disable authentication of the NATS server and are for testing
only, so operators securing a multi-node deployment are not misled into
weakening the connection they just enabled TLS on.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(registry): stop logging every service re-registration
RegisterService re-registers the service on a ticker so its TTL does
not lapse, and logged a debug line carrying the whole service record
on every tick. At the default 25s interval that is 3456 lines per
registration per day, and this tree has 20 non-test callers, so an
idle deployment at debug level writes tens of thousands of them with
no user interaction at all.
This is what the issue thread already agreed: only the error case is
worth a log there. The error branch is untouched, so a refresh that
fails still logs. The one-shot lines on first registration and on
deregistration are untouched too, because they fire once per process
rather than once per tick.
The test runs against the in-memory registry and fails on the
unmodified file. It lowers zerolog's global level first, because
importing ocis-pkg/log raises it to fatal in init() and the assertion
would otherwise pass on an empty buffer, and it requires the service
to still resolve after more than one TTL so the absence of a line
cannot be explained by a dead refresh loop.
The three review fixups are folded in here rather than kept as
separate commits: the changelog entry links the pull request ahead of
the issue, and the explanatory comment in register.go was dropped in
favour of this message.
Closes#8274.
Co-authored-by: Lukas Hirt <info@hirt.cz>
Master's LatestTag was still "8.0.0+dev" and its changelog/ folder
stopped at 8.0.4, even though 8.0.5-8.0.7, 8.1.0, and 8.2.0 have since
been released on their stable branches. The "bump master version"
step that normally follows a stable branch cut was skipped for both
the 8.1 and 8.2 cuts.
- Bump LatestTag to 8.2.0+dev, matching the latest actual release
(v8.2.0), consistent with how master has always been bumped after
a release (last released version + "+dev" placeholder, not the
next unreleased minor).
- Backport the missing changelog/8.0.5, 8.0.6, 8.0.7, 8.1.0, and
8.2.0 folders from their respective stable branches.
- Remove the now-duplicate fragments from changelog/unreleased/ that
those folders already cover (106 files) - verified by content/PR
match against every release folder, not just filename.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix: bump reva to allow space managers to remove others' shares
Space managers with the RemoveGrant permission on a resource could not
remove user shares created by other users; the share manager only allowed
the share's creator to remove it. This bumps reva to the commit that fixes
Unshare to also honor the RemoveGrant permission.
* fix(l10n): route gotext.Locale calls through func fields to satisfy go vet
Bumping reva pulled in reva's go 1.26 requirement, and go 1.26's stricter
printf vet analyzer now sees through the OcisLocale interface to flag
gotext.Locale.Get as a printf-wrapper, breaking go test across 5 packages.
Forwarding through func fields hides that static trail from vet.
* feat(invitations): configurable Keycloak actions + working ocis_full SMTP
The invitations service already triggers Keycloak execute-actions-email after
provisioning a guest (service.Invite -> backend.SendMail ->
gocloak.ExecuteActionsEmail). Two things still limited it:
- The required actions were hardcoded to UPDATE_PASSWORD,VERIFY_EMAIL. They are
now configurable via INVITATIONS_KEYCLOAK_EXECUTE_ACTIONS (comma-separated,
same default). Unknown actions are logged and skipped, and the service falls
back to the defaults if none remain valid so a guest always has a setup path.
- The Keycloak realm shipped with the ocis_full example had an empty smtpServer,
so Keycloak silently dropped every mail it tried to send, including the guest
invitation mail. The realm now points SMTP at the bundled mailpit
(mailserver:1025).
Verified: execute-actions-email delivers to mailpit against the ocis_full realm;
go test ./services/invitations/... ./ocis-pkg/keycloak/... -race passes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* fix(invitations): return the created user as invitedUser in the response
service.Invite echoed the request body unchanged, leaving the invitedUser
relation of the Graph invitation response empty, so a client could not learn
the identity of the guest that was just created. The keycloak backend now
records the created user (OWNCLOUD_ID, email, user type) on the invitation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* refactor(invitations): pass Keycloak actions through verbatim (no allowlist)
Address review (@kobergj): the configured execute-actions no longer need to
match a hardcoded enum. UserAction is now a string type passed to Keycloak
as-is, so operators can configure any required action their Keycloak supports
without oCIS keeping a list in sync. The convenience constants remain, the
default (UPDATE_PASSWORD, VERIFY_EMAIL) is unchanged, and validation is left to
Keycloak. Removes UserActionFromString and the two lookup maps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
---------
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: Add audience restriction for OIDC access tokens
* fix: add new envvar to added table
Signed-off-by: Martin Mattel <github@diemattels.at>
* fix: add updated env_vars.yaml file
* chore: var name to plural. update config
---------
Signed-off-by: Martin Mattel <github@diemattels.at>
Co-authored-by: Martin Mattel <github@diemattels.at>
* fix(proxy,graph): do not disable personal space on inconclusive permission check
When a user's role is (re-)assigned, both the proxy (on OIDC login) and the
graph appRoleAssignment handler check the Drives.Create permission to decide
whether to restore or disable the user's personal space. An indeterminate
permission result (transport error or a non-OK status other than
PERMISSION_DENIED) was treated as a denial, which disabled (trashed) the
personal space on a transient settings/gateway fault — with no automatic
re-enable. See OCISDEV-884.
Both call sites now fail closed: on an indeterminate result they leave the
personal space untouched, revert the just-persisted role assignment so the
user is not left in a half-applied state, and surface the error (the proxy
retries on the next login, the graph handler returns 500). Relies on the
matching reva utils.CheckPermission change that surfaces non-authoritative
statuses as an error.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* rebased
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat: metadata autopropagation
* feat: autoprop support for MFA / vault mode
* fix: replace some http clients with reva ones
* chore: required lib update
* fix: adjust unit tests and generate new mocks
* fix: apply autopropagation to all regular graph routes
* chore: updated reva dependency
* fix: return the right decorator for the thumbnails
* fix: remove autopropagation headers in the proxy
* feat: Implemet the vault-storage
feat: Separate the storage-users and graph to handle
feat: move the space create cache
configurate the vault srorage Postprocessing
hide the assignment of the MountID to VaultStorageProviderID behind a flag to avoid the ID mismatch
configurate the proxy to create the vault home space
update the filter
Make the graph able to handle vault prefix. no extra service needed
apply the vault filter to sharedbyme and sharedwithme
added vault-storage docker
use squashed reva
fix the finishUpload event
restict webdav copy/move from the vault
feat: provide the mfa to webdav and grpc
feat: refactoring: provide the mfa to webdav and grpc
mfa collaboration
fix GetRootDriveChildren and more
fix: send the MFA header in HTTP clients from the collaboration service
provide the default storage user vault configuration
update create_home middleware
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
Update services/gateway/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/proxy/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
bump reva
deduplicate the requireMFA middeware on vault routes. fix AppendPlainToOpaque.
added the changlog and comments
* feat: add the vault mode search
* Update changelog/unreleased/enhancement-vault-storage.md
Co-authored-by: Martin <github@diemattels.at>
* update the readme. the reva vault storage provider configuration disabled by default
* feat: [OCISDEV-531] add vault capabilities to the OCS capabilities endpoint
* the port range allocated. the configuration updated.
---------
Co-authored-by: Martin <github@diemattels.at>
Add NumericRestrictionNode to the KQL PEG grammar so that range
operators work with numeric values, not just DateTimes. This enables
queries like `size>=1048576`, `photo.iso>=100`, `photo.fNumber>=2.8`,
and `photo.focalLength<50`.
Changes:
- ast: add NumericNode with Key, Operator, Value (float64)
- kql/dictionary.peg: add NumericRestrictionNode and Number rules
- kql/factory.go: add buildNumericNode()
- kql/cast.go: add toFloat64()
- bleve/compiler.go: compile NumericNode to NumericRangeQuery
Fixes: #12093
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The server handlers for go-micro reuse the data from reva so the
propagation also works with reva services.
Both reva and go-micro services will propagate the data correctly.
This change enables photo gallery applications to access EXIF metadata
through the search API.
Changes:
- Add KQL query support for photo fields:
- photo.takenDateTime (datetime range queries)
- photo.cameraMake, photo.cameraModel (keyword queries)
- photo.fNumber, photo.focalLength, photo.iso (numeric queries)
- Configure Bleve index to store photo fields (Store=true)
- Map photo metadata from Bleve hits to Entity.Photo protobuf
- Add oc:photo-* properties to WebDAV search responses
- Add unit tests for photo field queries
The photo metadata is extracted by Tika during indexing and stored
in the Bleve search index. This enables queries like:
photo.takenDateTime:[2023-01-01 TO 2023-12-31]
photo.cameraMake:Canon
Signed-off-by: Paul Faure <paul@faure.ca>
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
On IPv6-only deployment I encountered two problem with collaboration service
and CheckHandler:
* getOutBoundIP() did not allow IPv6 addresses to be used as outbound
* FailSaveAddress() did double interpolation of the "::" literal on
GUA IPv6 addresses containing "::"
For now, only some hardcoded paths will check the claims (if there is a
checker configured). If the check fails for those paths, the
authentication will fail and it will return a 401 error
Middleware in the webdav service was missing. Telemetry for webdav was
relying on the otelchi middleware that was added afterwards and removed
in the previous commit. New (otelhttp) telemetry has been added to the
middlewares for the service.
Incoming telemetry data from HTTP (captured with otelhttp) with also be
stored so the telemetry for go-micro's requests can be picked up and
propagate properly.
otelchi and other custom solutions have been replaced with otelhttp to
trace HTTP requests; new middleware is provided to be used across the
platform.
The proxy service will use a custom HTTP client to forward the headers
needed for telemetry automatically (also based on otelhttp)
