* chore(OCISDEV-900): bump reva to pr7-switchover, add upload_directory and mount_id to revaconfig
* chore(OCISDEV-900): bump reva to the switchover rebased on the upload write fix
* chore(OCISDEV-900): bump reva to main with the upload coordinator switchover
---------
Co-authored-by: Firas Frikha <firas.frikha@kiteworks.com>
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
* chore: bump reva
* chore: bump pnpm dependencies
* fix: avoid go vet false positive in userlog conversion.go
The go.mod bump to go 1.26.8 made go vet flag loadTemplates' calls to
t.Get(nt.Subject/nt.Message) as non-constant format strings, breaking
the build for services/userlog/pkg/service. These are translation
lookup keys, not printf format strings, so route the call through a
local func value to defeat vet's static trace.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* chore: bump grpc
Fixes GO-2026-6443, a server panic when handling requests missing
authority or Host headers, flagged by govulncheck in CI.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
fix(deps): bump reva to pull in ErrNotExist->NotFound fix for RestoreRecycleItem
Restoring an already-restored/purged trash item returned 500 CODE_INTERNAL
instead of 404. Fixed upstream in owncloud/reva#740; bump the vendored reva
to 98fec04d9 to pick it up.
A MOVE whose source and destination resolve to the same resource is now
answered with 204 No Content server side instead of a confusing 403 or
404, and instead of 409 Conflict on the id based dav route, so every
client behaves the same way. The no-op still requires the move
permission.
The server-side guard lives in reva (owncloud/reva#708 and the follow-up
owncloud/reva#713, which moves the guard above the recursion checks so it
is also reached when the request addresses the resource by its id).
Pulled in here by bumping reva to v2.0.0-20260813121157-d386075a0421.
vendor/ was regenerated with `go mod vendor`; no hand edits.
On the test side the @issue-1976 tags are dropped from the five MOVE
feature files and the corresponding entries are removed from both
expected-failures lists. Scenario Outlines that mix roles with and
without the move permission parameterize the expected status in an extra
http-status-code Examples column rather than being split into duplicate
scenarios. The gherlint newline_before_scenario rule is configured as
["error", 2, true], counting tag lines toward the total, so the eight
scenarios that lost their tag get back the blank line it occupied.
Drop the "viewer" row from the same-name Examples table in
moveByFileId.feature: "viewer" is not a valid space role for a
permissionsRole invitation, so the step errored with
Role 'viewer' not found, and the "Space Viewer" row already covers
the 403.
Bump reva to pick up the fix for upload sessions whose node metadata can no
longer be read. Such sessions can never finish postprocessing, stay in
processing state indefinitely and keep consuming the quota of their space.
Cleaning them previously removed the uploaded bytes without releasing the quota.
Wire up the new Orphaned session filter so operators can list the affected
sessions and remove them with --clean:
ocis storage-users uploads sessions --orphaned
ocis storage-users uploads sessions --orphaned --clean
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
* feat: bump reva
Bumps reva to 441d6e77b33d, pulling in the vault/non-vault share
mountpoint collision fix, decomposedfs DisableVersioning aspect
handling, ChunkHandler.Assemble/scan fields, and LDAP retry policy
config. Also picks up the transitive nats-server, grpc, go-sqlite3
and antithesis-sdk-go bumps from reva's go.mod.
* docs: add changelog for vault share mountpoint collision fix
Documents the reva fix (owncloud/reva#691) that stops resources shared
under the same name from vault and non-vault mountpoints from getting
a spurious (1) suffix.
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12689
* fix: bump reva to allow space managers to remove others' shares
Space managers with the RemoveGrant permission on a resource could not
remove user shares created by other users; the share manager only allowed
the share's creator to remove it. This bumps reva to the commit that fixes
Unshare to also honor the RemoveGrant permission.
* fix(l10n): route gotext.Locale calls through func fields to satisfy go vet
Bumping reva pulled in reva's go 1.26 requirement, and go 1.26's stricter
printf vet analyzer now sees through the OcisLocale interface to flag
gotext.Locale.Get as a printf-wrapper, breaking go test across 5 packages.
Forwarding through func fields hides that static trail from vet.
* fix: [OCISDEV-810] fix the space role and custom role checks
* test: [OCISDEV-810] expect 400 when updating a share to a disabled role
The update (PATCH) permission handlers now enforce the admin role
allowlist, consistent with invite. Updating a share to a disabled role
(Secure Viewer, Denied, Space Editor Without Versions) therefore returns
400 instead of the previous silent 200. Update the @issue-10768 scenarios
to assert the new, correct behavior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* build(deps): [OCISDEV-949] bump reva to v2.0.0-20260709150645-a9d5432e6f7f
Includes owncloud/reva#651, which adds the enable_user_sharing and
enable_public_sharing config options this feature depends on.
* feat: [OCISDEV-949] add options to disable direct and public sharing
Adds two independent, per-deployment config options:
- OCIS_ENABLE_USER_SHARING (default true), read by the frontend, graph,
sharing and ocm services. When false, creating new user, group or
federated shares is rejected (via reva's usershareprovider and
ocmshareprovider, and via the graph Invite endpoint for the modern web
client), the legacy sharees search endpoint returns no results, and
the files_sharing.user.enabled / user_enumeration.enabled capabilities
report false so the web UI hides the "share with people" search.
Space membership invites are exempt.
- OCIS_ENABLE_PUBLIC_SHARING (default true), read by the frontend and
sharing services. When false, creating new public links is rejected
via reva's publicshareprovider, and files_sharing.public.enabled
reports false so the web UI hides public link creation.
The two settings are fully independent of each other.
* feat: metadata autopropagation
* feat: autoprop support for MFA / vault mode
* fix: replace some http clients with reva ones
* chore: required lib update
* fix: adjust unit tests and generate new mocks
* fix: apply autopropagation to all regular graph routes
* chore: updated reva dependency
* fix: return the right decorator for the thumbnails
* fix: remove autopropagation headers in the proxy
* fix: [OCISDEV-873] *WithoutTrashbin space editor roles render files as read-only in Web frontend
* fix: ci after godata bump
ocis CI bumped github.com/CiscoM31/godata from v1.0.10 → v1.0.11 as a transitive dependency of the reva bump. The new godata version parses "mail add 10 (invalid operator) as a parse error → 400 instead of unsupported operation → 501.
* fix ci: more precise role
* fix: bump reva to pull fix merged into reva
Adds a new space membership role "Can edit" that allows creating, uploading,
downloading, editing, moving and deleting on a space without access to file
versions or the trashbin. Also bumps reva to include the corresponding role
constructor.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Added the `spaceId` to the incoming shares. This is aligning the graph
API with the WebDAV API where the clients can use `spaceid` property.
This change allows clients to get the space ID directly instead of
having to parse the resource ID.
