* fix: [OCISDEV-1523] fix the LDAP master-ID filter for an empty base filter
EnhanceFilterWithMasterID replaced an empty LDAP filter with a master-ID-only
filter. This action restricted an unrestricted search to master-ID users
only. The bug broke the cross-instance user search in multi-instance
deployments. The function now keeps an empty filter unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: [OCISDEV-1523] require an explicit LDAP user filter with a master ID
EnhanceFilterWithMasterID in ocis-pkg/ldap/filter.go now keeps an empty
LDAP filter unchanged instead of restricting it to master-ID users only.
The auth-basic, users, groups, and graph services reuse this function to
compute their default LDAP user filter at startup.
An unset filter now means these services resolve or authenticate every
user in the shared LDAP directory, not only master-ID users. This action
is a behavior change for a deployment that sets
OCIS_MULTI_INSTANCE_MASTER_ID without an explicit OCIS_LDAP_USER_FILTER.
Each service now rejects startup when OCIS_MULTI_INSTANCE_MASTER_ID is
set and its own user filter is empty. This action keeps a multi-instance
deployment scoped to its own users by default.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* refactor: [OCISDEV-1523] simplify EnhanceFilterWithMasterID guard clauses
The function collapses three early-return guards into one condition.
This action removes a duplicated rationale comment between filter.go
and filter_test.go.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* docs: [OCISDEV-1523] point the changelog entry at the master backport PR
The changelog entry pointed at PR 13096, the stable-8.2 backport. This
commit points the entry at the master-branch PR number instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The next oCIS release is 9.0.0, so all envvars that were annotated with
the previously planned 8.3.0 introduction version need to be updated.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat(audit): record tag changes in the audit log
Graph publishes TagsAdded and TagsRemoved on every tag assign and unassign,
but only the search service listened, so a tag change left no trace in the
audit log.
The audit service now registers both events and logs them as file_tags_add
and file_tags_remove, with the acting user (Executant), the space owner, the
file id and path, and the comma-separated tags. Graph sets the Timestamp on
both events, which it left unset. Two test cases use different owner and
actor ids; the audit README documents the two actions.
Fixes#13054
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Paul Faure <paul@faure.ca>
* fix(audit): record only the tags that actually changed; skip no-op tag events
Review follow-up for #13055:
- graph: TagsAdded/TagsRemoved now carry the tags that were actually added
or removed (requesting an existing tag, or removing an absent one, is not
a change). Search only uses the event's Ref, so it is unaffected.
- audit: skip tag events whose tag list is empty. Graph still publishes
TagsRemoved for search when nothing was present; that is not an audit event.
- audit: document why User is the executant for tag events; describe Tags
as carried by the event; remove a stray copy-pasted doc comment.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpoeSoKYEdgQcWjEzTVKpT
Signed-off-by: Paul Faure <paul@faure.ca>
* fix(audit): carry the requested tags in tag events, as before
Per review: TagsAdded/TagsRemoved go back to carrying the tags as
requested, and the audit log records every request, including tags that
were already present (or absent, for a removal), so repeated requests stay
visible. Computing the actual delta belongs in the tags package, not here.
Removes the graph-side tagsDiff helper and its test, and the audit
service's skip for empty tag lists. The other review fixes stay.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpoeSoKYEdgQcWjEzTVKpT
Signed-off-by: Paul Faure <paul@faure.ca>
---------
Signed-off-by: Paul Faure <paul@faure.ca>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
Searching for share recipients in the vault ("Safe") could take minutes,
because each search scanned the role assignments of every account in the
system. Vault eligibility is now checked only for the users the search
matched, a few at a time in parallel, so the search is about as fast as
outside the vault.
* fix: use "ownCloudUUID" as attribute name everywhere
* fix: use "displayName" as LDAP attribute
* fix: ensure the WopiFolderURLBaseURL always ends with "/"
* fix: restore wrong substitution
* Revert "fix: use "displayName" as LDAP attribute"
This reverts commit 02de7a2db7.
Note that the default values outside of the graph service still remains
Change the documented introductionVersion of the
OCIS_LDAP_INSTANCE_MAPPER_CACHE_TTL environment variable from 8.0.0 to 8.3.0.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12689
fix(graph): [OCISDEV-492] reject space images too large to be rendered
Setting a space image larger than the thumbnails service accepts appeared
to succeed but never changed the space image. Uploading the file and
assigning it as the space image are two separate requests, and both
completed successfully, so clients reported success. Only a later preview
request, which the assigning client never observes, was rejected because
the image exceeded THUMBNAILS_MAX_INPUT_IMAGE_FILE_SIZE. As space images
are rendered exclusively as thumbnails, the image was not merely degraded,
it was invisible with no error anywhere in the UI.
The graph service now stats the file when a space image is assigned and
rejects the request with 413 Request Entity Too Large instead of storing a
reference which cannot be displayed. The previous space image is left
untouched. The limit is read from the new GRAPH_MAX_IMAGE_FILE_SIZE
setting, which defaults to the value of
THUMBNAILS_MAX_INPUT_IMAGE_FILE_SIZE so that a single setting keeps both
services in agreement. A limit of zero disables the check. Space
descriptions (readme) are not affected.
* feat(graph): eliminate LDAP read-after-write on create/update
Every graph LDAP create/update wrote the entry, then immediately re-read it
back by DN solely to recover the entry ID for the response model. Against a
replicated directory reached through a proxy, that read-back can hit a lagging
replica and fail or return stale data.
When oCIS generates the UUID itself (GRAPH_LDAP_SERVER_UUID disabled, the
default), the read-back returns nothing new: create responses are now
synthesized from the data already sent, and update responses are built by
folding the applied modifications onto the entry read before the write. When
the directory assigns the ID (GRAPH_LDAP_SERVER_UUID enabled), creates keep the
existing read-back since the generated ID cannot otherwise be recovered.
New ldap_writeback.go with two pure helpers:
- attrsFromAddRequest: flatten an AddRequest for ldap.NewEntry (create paths)
- applyModifyToEntry: fold a ModifyRequest (Replace/Add/Delete,
case-insensitive, non-mutating, ByteValues populated for octet-string id
parity) onto a copy of the pre-read entry (update paths)
All 9 write sites updated:
- creates (user, group, education user/class/school): synthesize when the ID is
client-generated, keep the read-back when the server assigns it
- updates (user, education user): fold the ModifyRequest onto the pre-read
entry; the AccountEnabled trailing override and the rename read-back inside
changeUserName are preserved (rename is out of scope)
- education school update: updateSchoolProperties now returns its ModifyRequest
so the caller can fold it; the displayName ModifyDN rename is folded as a
displayName attribute replace
- education class update: pre-read widened from name/id only to the full
education-class attribute set so classification/externalID are not dropped
from the response; the externalID ModifyDN rename is folded as an attribute
replace
Model builders are untouched, preserving the response shape. Existing update
tests were reconciled: read-back Search mocks that are no longer issued were
removed and the pre-read fixtures now carry the full baseline entry, with all
assertions unchanged.
OCISDEV-1033
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: hardcoded groupAttributeMap.id and wrong getLDAPGroup filter
* fix(graph): reject octet-string IDs without server-assigned UUIDs
Octet-string ID attributes (e.g. Active Directory's objectGUID) are assigned by
the directory server and require GRAPH_LDAP_SERVER_UUID=true. With
GRAPH_LDAP_SERVER_UUID=false oCIS generates the ID and writes it as a string
UUID, so an octet-string ID attribute would be decoded from raw string bytes
and produce a corrupt ID on both the read-back and the synthesize path.
NewLDAPBackend now rejects this incompatible combination at startup instead of
silently returning bad IDs.
Also adds regression tests for the id-attribute and group-name lookup fixes:
- CreateGroup / CreateEducationClass synthesize the response id under the
configured GroupIDAttribute (not a hardcoded attribute name)
- getLDAPGroupByNameOrID filters by the group name attribute, not the user one
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: update the staled DN
* test(graph): assert no read-back by search scope, not hard-coded DN
The synthesize-on-create test matched the read-back on a hard-coded
createdDN whose correctness relied on the school base DN being empty.
Match on ScopeBaseObject instead: DN-independent and precise about the
read-back being eliminated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: fixed calling it with a nil argumets. prevent the slice mutations
* chore: tests
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The errgroup workers converting CS3 shares into Graph DriveItems read from
the shared driveItems map while the collecting loop was already writing
results into the same map. The results channel is buffered, so workers never
blocked on the handover and the collecting loop started writing while workers
were still reading. The Go runtime aborts the process on a detected
concurrent map read and write, which is unrecoverable and dropped all
in-flight connections.
Collect the results after all workers have finished instead. Applies to
cs3UserSharesToDriveItems, cs3OCMSharesToDriveItems and
cs3PublicSharesToDriveItems, which all shared the same pattern.
Lowering OCIS_MAX_CONCURRENCY/GRAPH_MAX_CONCURRENCY was not a workaround: a
single worker still ran concurrently with the collecting loop.
(cherry picked from commit 2922769be9)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The /graph/v1.0/me endpoint reported the internal user UUID as
identities[].issuerAssignedId instead of the OIDC sub. The fast path
built the user model from the CS3 context user, which does not carry the
external identity. /me now always resolves the user through the identity
backend; group memberships are still only expanded on $expand=memberOf.
Forward-port of #12411 to master.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The groups API could return group membership details to callers who
should not have had access to it via the single-group GET endpoint.
Access to group member data is now properly restricted based on the
caller's permissions.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix: [OCISDEV-810] fix the space role and custom role checks
* test: [OCISDEV-810] expect 400 when updating a share to a disabled role
The update (PATCH) permission handlers now enforce the admin role
allowlist, consistent with invite. Updating a share to a disabled role
(Secure Viewer, Denied, Space Editor Without Versions) therefore returns
400 instead of the previous silent 200. Update the @issue-10768 scenarios
to assert the new, correct behavior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* build(deps): [OCISDEV-949] bump reva to v2.0.0-20260709150645-a9d5432e6f7f
Includes owncloud/reva#651, which adds the enable_user_sharing and
enable_public_sharing config options this feature depends on.
* feat: [OCISDEV-949] add options to disable direct and public sharing
Adds two independent, per-deployment config options:
- OCIS_ENABLE_USER_SHARING (default true), read by the frontend, graph,
sharing and ocm services. When false, creating new user, group or
federated shares is rejected (via reva's usershareprovider and
ocmshareprovider, and via the graph Invite endpoint for the modern web
client), the legacy sharees search endpoint returns no results, and
the files_sharing.user.enabled / user_enumeration.enabled capabilities
report false so the web UI hides the "share with people" search.
Space membership invites are exempt.
- OCIS_ENABLE_PUBLIC_SHARING (default true), read by the frontend and
sharing services. When false, creating new public links is rejected
via reva's publicshareprovider, and files_sharing.public.enabled
reports false so the web UI hides public link creation.
The two settings are fully independent of each other.
* feat(graph): [OCISDEV-1022] allow disabling last sign-in timestamp update
Add a new setting OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE /
GRAPH_LDAP_UPDATE_LAST_SIGNIN_DATE (default true) to disable maintaining the
'oCLastSignInTimestamp' LDAP attribute on user sign-in. When set to false the
graph service no longer listens for UserSignedIn events and does not write the
attribute, without having to disable all LDAP writes or the events consumer.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(changelog): [OCISDEV-1022] fix PR link to 12522
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(graph): [OCISDEV-1022] cover last sign-in toggle; address review
- Add unit test covering both branches of StartListenForLogonEvents
(subscribes when UpdateUserLastSignInDate is enabled, not when disabled).
- Set introductionVersion to 8.2.0.
- Reword the config description: the two settings are independent, the
timestamp is only persisted when OCIS_LDAP_SERVER_WRITE_ENABLED is enabled
rather than the toggle requiring it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Martin <github@diemattels.at>
* fix(proxy,graph): do not disable personal space on inconclusive permission check
When a user's role is (re-)assigned, both the proxy (on OIDC login) and the
graph appRoleAssignment handler check the Drives.Create permission to decide
whether to restore or disable the user's personal space. An indeterminate
permission result (transport error or a non-OK status other than
PERMISSION_DENIED) was treated as a denial, which disabled (trashed) the
personal space on a transient settings/gateway fault — with no automatic
re-enable. See OCISDEV-884.
Both call sites now fail closed: on an indeterminate result they leave the
personal space untouched, revert the just-persisted role assignment so the
user is not left in a half-applied state, and surface the error (the proxy
retries on the next login, the graph handler returns 500). Relies on the
matching reva utils.CheckPermission change that surfaces non-authoritative
statuses as an error.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* rebased
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
ListPermissions only special-cased the $select for the roles allowedValues, so
a request selecting only @libre.graph.permissions.actions.allowedValues still
received the roles allowedValues too. Add the symmetric projection: when actions
are selected, drop the roles allowedValues and skip the share lookup, mirroring
the existing roles-only path.
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: metadata autopropagation
* feat: autoprop support for MFA / vault mode
* fix: replace some http clients with reva ones
* chore: required lib update
* fix: adjust unit tests and generate new mocks
* fix: apply autopropagation to all regular graph routes
* chore: updated reva dependency
* fix: return the right decorator for the thumbnails
* fix: remove autopropagation headers in the proxy
DeleteEducationUser called the LDAP backend with user.GetExternalID(),
while the regular /users handler and the pre-v8.0 code path used
user.GetId(). With the default RequireExternalID=false, the LDAP backend
looked up the user by name-or-UUID, so the externalID never matched, the
LDAP entry was never removed, and the response was a 404.
(cherry picked from commit 27c9de6c72)
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* chore: release 8.0.0-rc.1
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* [docs-only] Fix of storage-publiclink readme
* fix: some notifications were translated wrong due to an empty l10n key
The expected translatable message was empty, which caused the
translation system to use the empty key, which contains "weird"
unrelated data.
With the fix, if there is no translatable message, the related output
will remain empty.
* [docs-only][stable-8.0] Update web-extensions image versions in ocis_full
* feat: bump go to 1.25
feat: bump mockery to v2.53.5
feat: bump govulncheck
feat: bump bingo to v0.10.0
force go-1.25.7
update thumbnail images for test
* chore: bump web to v12.3.1
* fix: ocis-multi deployment example groups
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.0
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: add v8 to production versions
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: write to docs-stable branch
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* test: fix public link related test for k8s deployment
* chore(idp): use kpop without dependency
Instead of trying to download kpop every time, bring in the specific
code that we are using. There is very little code that we are actually
using from kpop so pulling it as a dependency is not really necessary
and it should fix the current CI issues.
* fix: codacy deprecated reporter
* fix: post rebase cleanup
* chore(web): bump ownCloud Web to v12.3.2
* fix(graph): Don't use hardcoded groupOfNames in group creation
* fix(graph): (ai) fix other groupOfNames and comment
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* test: let (ai) add a test for it
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: adjust ocis-multi example
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* docs: update changelog item
Co-authored-by: Martin <github@diemattels.at>
* fix:[OCISDEV-617] Expose the signature-auth attribute
* ci: use plugins/s3:1.4.0
* fix: dont write externalID when empty
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* feat: add globalID for EK users
* fix: bump reva version
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.1
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* [backport] feat: [OCISDEV-732] acceptance test (#12143) to stable-8.0.0 (#12236)
* feat: [OCISDEV-732] acceptance test (#12143)
* feat: acceptance test - graph
* feat: acceptance test - graph
* feat: acceptance test - graph
* fix: remove drone
* feat: run each behat suite as a separate worker
* feat: rename
feat: [OCISDEV-740] acceptance test, coverage P0
feat: [OCISDEV-743] build and unit test
ci: [ocisdev-730] code quality
feat: [OCISDEV-741] local-api-test part 2
feat: [OCISDEV-741] local-api-test, apiSpaces
feat: [OCISDEV-744] cli-test
feat: [OCISDEV-741] local-api-test, apiCollaboration
# Conflicts:
# .github/workflows/acceptance-tests.yml
# tests/acceptance/run-github.py
feat: [OCISDEV-741] integration
feat: [OCISDEV-744] build-and-test, lint
feat: [OCISDEV-744] e2e-test
# Conflicts:
# .github/workflows/acceptance-tests.yml
feat: [OCISDEV-744] fix apiSearch2 test suite
* test [OCISDEV-744]: Run apiSearch2 test suite
* Added php8.4-gd to all 4 PHP install lines
* test [OCISDEV-744]: Enable all commented tests
* test [OCISDEV-744]: Fixed failings
* test [OCISDEV-744]: Fixed failings
feat: [OCISDEV-744] fix apiOcm test suite
* test [OCISDEV-744]: fix apiOcm tests
* test [OCISDEV-744]: remove redundant .sh files
* test [OCISDEV-744]: remove run-e2e.sh. Fix DRY vialation in run-github.py
* test [OCISDEV-744]: documentation fixes
---------
Co-authored-by: Deyan Zhekov <deyan.zhekov@kiteworks.com>
fix: [OCISDEV-730] actions compliance (#12187)
feat: [OCISDEV-786] Split coreApiSharees and coreApiSharePublicLink2 (#12196)
feat: [OCISDEV-779] reduce ci duration, libcurl (#12193)
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
* feat: [OCISDEV-779] reduce ci duration, libcurl
feat: [OCISDEV-792] reduce ci duration, build-and-run (#12204)
* feat: [OCISDEV-792] reduce ci duration, build-and-run
* feat: [OCISDEV-792] reduce ci duration, build-and-run
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
* feat: [OCISDEV-792] reduce ci duration, pre-check
fix: ci, govulncheck stderr (#12219)
* fix: ci, govulncheck stderr
* fix: ci, litmus flakines
feat: [OCISDEV-779] reduce CI duration, PHP-version (#12217)
* feat: [OCISDEV-779] reduce CI duration, php-version
* feat: [OCISDEV-779] fix flaky test in apiSharingNgShares
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] replace manual PHP installation with shivammathur/setup-php action
* feat: [OCISDEV-779] fix Pre-checks and generate step
* feat: [OCISDEV-779] fix flaky preview comparison
* feat: [OCISDEV-779] fix failing test
---------
Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
* feat: post rebase fix
* feat: post rebase fix
* feat: post rebase fix
* feat: [OCISDEV-783] release pipeline (#12194) (#12235)
* feat: Add basic GH Actions file
* feat: [OCISDEV-783] release pipeline
* feat: [OCISDEV-783] release pipeline
* feat: [OCISDEV-783] release pipeline, DeepDiver's review comments
* feat: [OCISDEV-783] release pipeline, DeepDiver's review comments
* feat: [OCISDEV-783] release pipeline, assert release
* feat: [OCISDEV-783] release pipeline, audit release
* feat: [OCISDEV-783] release pipeline, bianaries
* feat: [OCISDEV-783] release pipeline, bianaries
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, dev.1
* feat: [OCISDEV-783] release pipeline, trivy scan
* feat: [OCISDEV-783] release pipeline, gh actions
* trigger CI
* feat: [OCISDEV-783] release pipeline, align versions
* feat: [OCISDEV-783] release pipeline, scan message
* feat: [OCISDEV-783] release pipeline, ack alpine scan
* feat: [OCISDEV-783] release pipeline, align versions
* feat: [OCISDEV-783] release pipeline, review
* feat: [OCISDEV-783] release pipeline, review
* feat: [OCISDEV-783] release pipeline, trivy scan
---------
Co-authored-by: Lukas Schwarz <lukas.schwarz@kiteworks.com>
* feat(graph): [OCISDEV-794] allow multiple objectClasses on group creation
Add GroupAdditionalObjectClasses config field (env vars
OCIS_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES /
GRAPH_LDAP_GROUP_ADDITIONAL_OBJECTCLASSES) that appends extra
objectClasses when creating groups in LDAP, alongside the existing
primary GroupObjectClass. Applied to both groupToLDAPAttrValues and
CreateLDAPGroupByDN.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* feat(webdav): [OCISDEV-602] add spaceid to report
Added the `spaceid` to the REPORT responses. This is aligning the
`REPORT` method with the `PROPFIND` method.
* build(deps): stable-8.0
* feat(graph): [OCISDEV-807] add SpaceEditorWithoutVersionsWithoutTrashbin role
Adds a new space membership role "Can edit" that allows creating, uploading,
downloading, editing, moving and deleting on a space without access to file
versions or the trashbin. Also bumps reva to include the corresponding role
constructor.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix(collaboration): [OCISDEV-781] return 200 OK for WOPI Lock in read-only modes
OnlyOffice sends a WOPI Lock request on document open regardless of whether
the user has write access. The Lock handler was calling SetLock with a
read-only CS3 token, which returned a permission error propagated as HTTP 500
to OnlyOffice, causing an error dialog on load.
Return 200 OK immediately for READ_ONLY and VIEW_ONLY view modes without
acquiring a CS3 lock.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: fixed the internal links access control
* use the web stable-12.3 latest
* fix the OCM share permission change notification handling
* [OCISDEV-830] Add GitHub Actions workflow for k6 load tests with flag [k6-test]
* [OCISDEV-827] Add workflow file to run k6-tests in GitHub Actions
* [OCISDEV-827] Fix broken pipeline job
* [OCISDEV-827] Fix broken pipeline job - switched to double quotes.
* [OCISDEV-827] Trying to fix a broken pipeline job
* [OCISDEV-827] Fix secrets and variables used to run k6-test
* [OCISDEV-827] Add health check and SSH keepalive in run_k6_tests.sh
* [OCISDEV-827] Rename variable DRONE_COMMIT to OCIS_COMMIT_SHA
* chore: bump web version to 12.3.3
* [OCISDEV-833] Added rm -rf k6-ocis via SSH before ocis.sh start (#12280)
* fix(proxy): [OCISDEV-845] skip space reconciliation on signed URL requests
The space management middleware removed users from all project spaces
when processing signed URL requests because no OIDC claims are present
in that auth context. Return early when claims are nil to prevent the
oscillating add/remove cycle.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore(proxy): [OCISDEV-845] add changelog for space manager fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: release 8.0.2
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* chore: bump libvips (#12304)
* chore: bump go version (#12306)
* fix: [OCISDEV-864] CI, fix passing version string value to image (#12309) (#12319)
* fix: release fix passing version string value to image
* fix: bump release tag
* chore: bump go-git
* fix: missing fcntl64 int the build image due to GHA image update
* fix: [OCISDEV-865] CI, release pipeline steps ordering (#12310) (#12320)
* fix: ci, release pipeline steps ordering
* chore: security bump
* fix: ignore for trivy scan, steps order
# Conflicts:
# services/idp/package.json
# services/idp/pnpm-lock.yaml
* fix: [backport][OCISDEV-873] *WithoutTrashbin space editor roles render files read-only in Web frontend (#12351)
fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files read-only in Web frontend (#12346)
* fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files as read-only in Web frontend
* fix: ci after godata bump
ocis CI bumped github.com/CiscoM31/godata from v1.0.10 → v1.0.11 as a transitive dependency of the reva bump. The new godata version parses "mail add 10 (invalid operator) as a parse error → 400 instead of unsupported operation → 501.
* fix ci: more precise role
* fix: bump reva to pull fix merged into reva
* Release 8.0.4 (#12352)
chore: Release 8.0.4
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* fix: dont write externalID when empty
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
---------
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Martin Mattel <github@diemattels.at>
Co-authored-by: Juan Pablo Villafáñez <jvillafanez@solidgeargroup.com>
Co-authored-by: Roman Perekhod <2403905@gmail.com>
Co-authored-by: Roman Perekhod <rperekhod@owncloud.com>
Co-authored-by: Matteo <matteo.sonnenholzner@kiteworks.com>
Co-authored-by: Niraj Acharya <niraj@jankaritech.com>
Co-authored-by: Lukas Hirt <info@hirt.cz>
Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
Co-authored-by: Gwilherm Folliot <gwilherm55fo@gmail.com>
Co-authored-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-authored-by: Lukas Schwarz <lukas.schwarz@kiteworks.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Deyan Zhekov <deyan.zhekov@kiteworks.com>
Co-authored-by: Matteo <193476828+mzner@users.noreply.github.com>
fix: random order for user search attributes
getUsersAttributes ranged over a map, so the attributes slice came back
in non-deterministic order. Iterate over the configured displayedAttributes
slice instead.
* fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files as read-only in Web frontend
* fix: ci after godata bump
ocis CI bumped github.com/CiscoM31/godata from v1.0.10 → v1.0.11 as a transitive dependency of the reva bump. The new godata version parses "mail add 10 (invalid operator) as a parse error → 400 instead of unsupported operation → 501.
* fix ci: more precise role
* fix: bump reva to pull fix merged into reva
