Merge pull request #9980 from dragonchaser/fix-ocm-share-updates
Fix ocm share updates
This commit is contained in:
@@ -0,0 +1,6 @@
|
||||
Bugfix: Allow update of ocm shares
|
||||
|
||||
We fixed a bug that prevented ocm shares to be updated or removed.
|
||||
|
||||
https://github.com/owncloud/ocis/pull/9980
|
||||
https://github.com/owncloud/ocis/issues/9926
|
||||
@@ -2,6 +2,8 @@ Enhancement: Bump reva
|
||||
|
||||
Bumps reva version
|
||||
|
||||
https://github.com/owncloud/ocis/pull/9980
|
||||
https://github.com/owncloud/ocis/pull/9981
|
||||
https://github.com/owncloud/ocis/pull/9981
|
||||
https://github.com/owncloud/ocis/pull/9920
|
||||
https://github.com/owncloud/ocis/pull/9879
|
||||
|
||||
@@ -15,7 +15,7 @@ require (
|
||||
github.com/cenkalti/backoff v2.2.1+incompatible
|
||||
github.com/coreos/go-oidc/v3 v3.11.0
|
||||
github.com/cs3org/go-cs3apis v0.0.0-20240724121416-062c4e3046cb
|
||||
github.com/cs3org/reva/v2 v2.23.1-0.20240905133054-2de6ff31c4e3
|
||||
github.com/cs3org/reva/v2 v2.24.1-0.20240911132317-de8cea1f9e72
|
||||
github.com/dhowden/tag v0.0.0-20230630033851-978a0926ee25
|
||||
github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
|
||||
github.com/egirna/icap-client v0.1.1
|
||||
|
||||
@@ -255,8 +255,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
|
||||
github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
|
||||
github.com/cs3org/go-cs3apis v0.0.0-20240724121416-062c4e3046cb h1:KmYZDReplv/yfwc1LNYpDcVhVujC3Pasv6WjXx1haSU=
|
||||
github.com/cs3org/go-cs3apis v0.0.0-20240724121416-062c4e3046cb/go.mod h1:yyP8PRo0EZou3nSH7H4qjlzQwaydPeIRNgX50npQHpE=
|
||||
github.com/cs3org/reva/v2 v2.23.1-0.20240905133054-2de6ff31c4e3 h1:L1fD7ShX6W17e5YMgWpcmCq2KVHQy48gFrnc261iohQ=
|
||||
github.com/cs3org/reva/v2 v2.23.1-0.20240905133054-2de6ff31c4e3/go.mod h1:p7CHBXcg6sSqB+0JMNDfC1S7TSh9FghXkw1kTV3KcJI=
|
||||
github.com/cs3org/reva/v2 v2.24.1-0.20240911132317-de8cea1f9e72 h1:J1CCIbBOKVGEqEng3OwZzeX5jVLb8iTzM251D2C8oyo=
|
||||
github.com/cs3org/reva/v2 v2.24.1-0.20240911132317-de8cea1f9e72/go.mod h1:p7CHBXcg6sSqB+0JMNDfC1S7TSh9FghXkw1kTV3KcJI=
|
||||
github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
|
||||
github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
|
||||
github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
|
||||
|
||||
@@ -16,15 +16,16 @@ import (
|
||||
ocm "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
|
||||
storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
|
||||
types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
|
||||
"github.com/go-chi/chi/v5"
|
||||
"github.com/go-chi/render"
|
||||
libregraph "github.com/owncloud/libre-graph-api-go"
|
||||
|
||||
revactx "github.com/cs3org/reva/v2/pkg/ctx"
|
||||
"github.com/cs3org/reva/v2/pkg/publicshare"
|
||||
"github.com/cs3org/reva/v2/pkg/rgrpc/todo/pool"
|
||||
"github.com/cs3org/reva/v2/pkg/share"
|
||||
"github.com/cs3org/reva/v2/pkg/storagespace"
|
||||
"github.com/cs3org/reva/v2/pkg/utils"
|
||||
"github.com/go-chi/chi/v5"
|
||||
"github.com/go-chi/render"
|
||||
libregraph "github.com/owncloud/libre-graph-api-go"
|
||||
|
||||
"github.com/owncloud/ocis/v2/ocis-pkg/l10n"
|
||||
l10n_pkg "github.com/owncloud/ocis/v2/services/graph/pkg/l10n"
|
||||
@@ -71,6 +72,7 @@ const (
|
||||
Public
|
||||
User
|
||||
Space
|
||||
OCM
|
||||
)
|
||||
|
||||
// NewDriveItemPermissionsService creates a new DriveItemPermissionsService
|
||||
@@ -463,6 +465,13 @@ func (s DriveItemPermissionsService) DeletePermission(ctx context.Context, itemI
|
||||
}
|
||||
}
|
||||
|
||||
if sharedResourceID == nil && s.config.IncludeOCMSharees {
|
||||
sharedResourceID, err = s.getOCMPermissionResourceID(ctx, permissionID)
|
||||
if err == nil {
|
||||
permissionType = OCM
|
||||
}
|
||||
}
|
||||
|
||||
switch {
|
||||
case err != nil:
|
||||
return err
|
||||
@@ -486,10 +495,12 @@ func (s DriveItemPermissionsService) DeletePermission(ctx context.Context, itemI
|
||||
return s.removePublicShare(ctx, permissionID)
|
||||
case Space:
|
||||
return s.removeSpacePermission(ctx, permissionID, sharedResourceID)
|
||||
case OCM:
|
||||
return s.removeOCMPermission(ctx, permissionID)
|
||||
default:
|
||||
// This should never be reached
|
||||
return errorcode.New(errorcode.GeneralException, "failed to delete permission")
|
||||
}
|
||||
|
||||
// This should never be reached
|
||||
return errorcode.New(errorcode.GeneralException, "failed to delete permission")
|
||||
}
|
||||
|
||||
// DeleteSpaceRootPermission deletes a permission on the root item of a project space
|
||||
@@ -515,6 +526,13 @@ func (s DriveItemPermissionsService) DeleteSpaceRootPermission(ctx context.Conte
|
||||
// UpdatePermission updates a permission on a drive item
|
||||
func (s DriveItemPermissionsService) UpdatePermission(ctx context.Context, itemID *storageprovider.ResourceId, permissionID string, newPermission libregraph.Permission) (libregraph.Permission, error) {
|
||||
oldPermission, sharedResourceID, err := s.getPermissionByID(ctx, permissionID, itemID)
|
||||
|
||||
// try to get the permission from ocm if the permission was not found first place
|
||||
if err != nil && s.config.IncludeOCMSharees {
|
||||
oldPermission, sharedResourceID, err = s.getOCMPermissionByID(ctx, permissionID, itemID)
|
||||
}
|
||||
|
||||
// if we still can't find the permission, return an error
|
||||
if err != nil {
|
||||
return libregraph.Permission{}, err
|
||||
}
|
||||
@@ -537,10 +555,20 @@ func (s DriveItemPermissionsService) UpdatePermission(ctx context.Context, itemI
|
||||
|
||||
// This is a user share
|
||||
updatedPermission, err := s.updateUserShare(ctx, permissionID, sharedResourceID, &newPermission)
|
||||
if err != nil {
|
||||
return libregraph.Permission{}, err
|
||||
if err == nil && updatedPermission != nil {
|
||||
return *updatedPermission, nil
|
||||
}
|
||||
return *updatedPermission, nil
|
||||
|
||||
// This is an ocm share
|
||||
if s.config.IncludeOCMSharees {
|
||||
updatePermission, err := s.updateOCMPermission(ctx, permissionID, itemID, &newPermission)
|
||||
if err == nil {
|
||||
return *updatePermission, nil
|
||||
}
|
||||
}
|
||||
|
||||
return libregraph.Permission{}, err
|
||||
|
||||
}
|
||||
|
||||
// UpdateSpaceRootPermission updates a permission on the root item of a project space
|
||||
|
||||
@@ -154,17 +154,17 @@ func (g BaseGraphService) cs3SpacePermissionsToLibreGraph(ctx context.Context, s
|
||||
// will have the same id.
|
||||
tmp := id
|
||||
isGroup := false
|
||||
var identity libregraph.Identity
|
||||
var cs3Identity libregraph.Identity
|
||||
var err error
|
||||
var p libregraph.Permission
|
||||
if _, ok := groupsMap[id]; ok {
|
||||
identity, err = groupIdToIdentity(ctx, g.identityCache, tmp)
|
||||
cs3Identity, err = groupIdToIdentity(ctx, g.identityCache, tmp)
|
||||
if err != nil {
|
||||
g.logger.Warn().Str("groupid", tmp).Msg("Group not found by id")
|
||||
}
|
||||
isGroup = true
|
||||
} else {
|
||||
identity, err = userIdToIdentity(ctx, g.identityCache, tmp)
|
||||
cs3Identity, err = userIdToIdentity(ctx, g.identityCache, tmp)
|
||||
if err != nil {
|
||||
g.logger.Warn().Str("userid", tmp).Msg("User not found by id")
|
||||
}
|
||||
@@ -173,17 +173,19 @@ func (g BaseGraphService) cs3SpacePermissionsToLibreGraph(ctx context.Context, s
|
||||
case APIVersion_1:
|
||||
var identitySet libregraph.IdentitySet
|
||||
if isGroup {
|
||||
identitySet.SetGroup(identity)
|
||||
identitySet.SetGroup(cs3Identity)
|
||||
} else {
|
||||
identitySet.SetUser(identity)
|
||||
identitySet.SetUser(cs3Identity)
|
||||
}
|
||||
p.SetGrantedToV2(libregraph.SharePointIdentitySet{User: identitySet.User, Group: identitySet.Group})
|
||||
// FIXME: needs to be removed
|
||||
p.SetGrantedToIdentities([]libregraph.IdentitySet{identitySet})
|
||||
case APIVersion_1_Beta_1:
|
||||
var identitySet libregraph.SharePointIdentitySet
|
||||
if isGroup {
|
||||
identitySet.SetGroup(identity)
|
||||
identitySet.SetGroup(cs3Identity)
|
||||
} else {
|
||||
identitySet.SetUser(identity)
|
||||
identitySet.SetUser(cs3Identity)
|
||||
}
|
||||
p.SetId(identitySetToSpacePermissionID(identitySet))
|
||||
p.SetGrantedToV2(identitySet)
|
||||
@@ -485,14 +487,14 @@ func (g BaseGraphService) cs3UserShareToPermission(ctx context.Context, share *c
|
||||
}
|
||||
perm.SetGrantedToV2(grantedTo)
|
||||
if share.GetCreator() != nil {
|
||||
identity, err := cs3UserIdToIdentity(ctx, g.identityCache, share.GetCreator())
|
||||
cs3Identity, err := cs3UserIdToIdentity(ctx, g.identityCache, share.GetCreator())
|
||||
if err != nil {
|
||||
return nil, errorcode.New(errorcode.GeneralException, err.Error())
|
||||
}
|
||||
perm.SetInvitation(
|
||||
libregraph.SharingInvitation{
|
||||
InvitedBy: &libregraph.IdentitySet{
|
||||
User: &identity,
|
||||
User: &cs3Identity,
|
||||
},
|
||||
},
|
||||
)
|
||||
@@ -571,14 +573,14 @@ func (g BaseGraphService) cs3OCMShareToPermission(ctx context.Context, share *oc
|
||||
}
|
||||
perm.SetGrantedToV2(grantedTo)
|
||||
if share.GetCreator() != nil {
|
||||
identity, err := cs3UserIdToIdentity(ctx, g.identityCache, share.GetCreator())
|
||||
cs3Identity, err := cs3UserIdToIdentity(ctx, g.identityCache, share.GetCreator())
|
||||
if err != nil {
|
||||
return nil, errorcode.New(errorcode.GeneralException, err.Error())
|
||||
}
|
||||
perm.SetInvitation(
|
||||
libregraph.SharingInvitation{
|
||||
InvitedBy: &libregraph.IdentitySet{
|
||||
User: &identity,
|
||||
User: &cs3Identity,
|
||||
},
|
||||
},
|
||||
)
|
||||
@@ -613,11 +615,11 @@ func (g BaseGraphService) cs3PublicSharesToDriveItems(ctx context.Context, share
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getLinkPermissionResourceID(ctx context.Context, permissionID string) (*storageprovider.ResourceId, error) {
|
||||
share, err := g.getCS3PublicShareByID(ctx, permissionID)
|
||||
cs3Share, err := g.getCS3PublicShareByID(ctx, permissionID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return share.GetResourceId(), nil
|
||||
return cs3Share.GetResourceId(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getCS3PublicShareByID(ctx context.Context, permissionID string) (*link.PublicShare, error) {
|
||||
@@ -641,9 +643,36 @@ func (g BaseGraphService) getCS3PublicShareByID(ctx context.Context, permissionI
|
||||
if err := errorcode.FromCS3Status(getPublicShareResp.GetStatus(), err); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return getPublicShareResp.GetShare(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) removeOCMPermission(ctx context.Context, permissionID string) error {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
g.logger.Debug().Err(err).Msg("selecting gatewaySelector failed")
|
||||
return err
|
||||
}
|
||||
|
||||
removePublicShareResp, err := gatewayClient.RemoveOCMShare(ctx,
|
||||
&ocm.RemoveOCMShareRequest{
|
||||
Ref: &ocm.ShareReference{
|
||||
Spec: &ocm.ShareReference_Id{
|
||||
Id: &ocm.ShareId{
|
||||
OpaqueId: permissionID,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
)
|
||||
if err := errorcode.FromCS3Status(removePublicShareResp.GetStatus(), err); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// We need to return an untyped nil here otherwise the error==nil check won't work
|
||||
return nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) removePublicShare(ctx context.Context, permissionID string) error {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
@@ -660,10 +689,12 @@ func (g BaseGraphService) removePublicShare(ctx context.Context, permissionID st
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
},
|
||||
)
|
||||
if err := errorcode.FromCS3Status(removePublicShareResp.GetStatus(), err); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// We need to return an untyped nil here otherwise the error==nil check won't work
|
||||
return nil
|
||||
}
|
||||
@@ -684,11 +715,12 @@ func (g BaseGraphService) removeUserShare(ctx context.Context, permissionID stri
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
},
|
||||
)
|
||||
if err := errorcode.FromCS3Status(removeShareResp.GetStatus(), err); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// We need to return an untyped nil here otherwise the error==nil check won't work
|
||||
return nil
|
||||
}
|
||||
@@ -714,20 +746,55 @@ func (g BaseGraphService) removeSpacePermission(ctx context.Context, permissionI
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
if err := errorcode.FromCS3Status(removeShareResp.GetStatus(), err); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// We need to return an untyped nil here otherwise the error==nil check won't work
|
||||
return nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getUserPermissionResourceID(ctx context.Context, permissionID string) (*storageprovider.ResourceId, error) {
|
||||
share, err := g.getCS3UserShareByID(ctx, permissionID)
|
||||
func (g BaseGraphService) getOCMPermissionResourceID(ctx context.Context, permissionID string) (*storageprovider.ResourceId, error) {
|
||||
cs3Share, err := g.getCS3OCMShareByID(ctx, permissionID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return share.GetResourceId(), nil
|
||||
|
||||
return cs3Share.GetResourceId(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getCS3OCMShareByID(ctx context.Context, permissionID string) (*ocm.Share, error) {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
g.logger.Debug().Err(err).Msg("selecting gatewaySelector failed")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
getShareResp, err := gatewayClient.GetOCMShare(ctx,
|
||||
&ocm.GetOCMShareRequest{
|
||||
Ref: &ocm.ShareReference{
|
||||
Spec: &ocm.ShareReference_Id{
|
||||
Id: &ocm.ShareId{
|
||||
OpaqueId: permissionID,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
)
|
||||
if err := errorcode.FromCS3Status(getShareResp.GetStatus(), err); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return getShareResp.GetShare(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getUserPermissionResourceID(ctx context.Context, permissionID string) (*storageprovider.ResourceId, error) {
|
||||
cs3Share, err := g.getCS3UserShareByID(ctx, permissionID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return cs3Share.GetResourceId(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getCS3UserShareByID(ctx context.Context, permissionID string) (*collaboration.Share, error) {
|
||||
@@ -746,13 +813,45 @@ func (g BaseGraphService) getCS3UserShareByID(ctx context.Context, permissionID
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
},
|
||||
)
|
||||
if err := errorcode.FromCS3Status(getShareResp.GetStatus(), err); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return getShareResp.GetShare(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getOCMPermissionByID(ctx context.Context, permissionID string, itemID *storageprovider.ResourceId) (*libregraph.Permission, *storageprovider.ResourceId, error) {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
g.logger.Debug().Err(err).Msg("selecting gatewaySelevtor failed")
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
ocmShare, err := g.getCS3OCMShareByID(ctx, permissionID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
resourceInfo, err := utils.GetResourceByID(ctx, itemID, gatewayClient)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
condition, err := roleConditionForResourceType(resourceInfo)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
permission, err := g.cs3OCMShareToPermission(ctx, ocmShare, condition)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
return permission, ocmShare.GetResourceId(), nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) getPermissionByID(ctx context.Context, permissionID string, itemID *storageprovider.ResourceId) (*libregraph.Permission, *storageprovider.ResourceId, error) {
|
||||
var errcode errorcode.Error
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
@@ -788,28 +887,138 @@ func (g BaseGraphService) getPermissionByID(ctx context.Context, permissionID st
|
||||
}
|
||||
case errors.As(err, &errcode) && errcode.GetCode() == errorcode.ItemNotFound:
|
||||
// there is no public link with that id, check if this is a user share
|
||||
share, err := g.getCS3UserShareByID(ctx, permissionID)
|
||||
cs3Share, err := g.getCS3UserShareByID(ctx, permissionID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
resourceInfo, err := utils.GetResourceByID(ctx, itemID, gatewayClient)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
condition, err := roleConditionForResourceType(resourceInfo)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
permission, err := g.cs3UserShareToPermission(ctx, share, condition)
|
||||
|
||||
permission, err := g.cs3UserShareToPermission(ctx, cs3Share, condition)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return permission, share.GetResourceId(), nil
|
||||
|
||||
return permission, cs3Share.GetResourceId(), nil
|
||||
}
|
||||
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
func (g BaseGraphService) updateOCMPermission(ctx context.Context, permissionID string, itemID *storageprovider.ResourceId, newPermission *libregraph.Permission) (*libregraph.Permission, error) {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
g.logger.Debug().Err(err).Msg("selecting gatewaySelector failed")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resourceInfo, err := utils.GetResourceByID(ctx, itemID, gatewayClient)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
condition, err := federatedRoleConditionForResourceType(resourceInfo)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var cs3UpdateOCMShareReq ocm.UpdateOCMShareRequest
|
||||
cs3UpdateOCMShareReq.Ref = &ocm.ShareReference{
|
||||
Spec: &ocm.ShareReference_Id{
|
||||
Id: &ocm.ShareId{
|
||||
OpaqueId: permissionID,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if expiration, ok := newPermission.GetExpirationDateTimeOk(); ok {
|
||||
cs3UpdateOCMShareReq.Field = append(
|
||||
cs3UpdateOCMShareReq.Field,
|
||||
&ocm.UpdateOCMShareRequest_UpdateField{
|
||||
Field: &ocm.UpdateOCMShareRequest_UpdateField_Expiration{
|
||||
Expiration: utils.TimeToTS(*expiration),
|
||||
},
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
var allowedResourceActions []string
|
||||
var permissionsUpdated bool
|
||||
if roles, ok := newPermission.GetRolesOk(); ok {
|
||||
if len(roles) > 0 {
|
||||
for _, roleID := range roles {
|
||||
role, err := unifiedrole.GetRole(unifiedrole.RoleFilterIDs(roleID))
|
||||
if err != nil {
|
||||
g.logger.Debug().Err(err).Interface("role", role).Msg("unable to convert requested role")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
allowedResourceActions = unifiedrole.GetAllowedResourceActions(role, condition)
|
||||
if len(allowedResourceActions) == 0 {
|
||||
return nil, errorcode.New(errorcode.InvalidRequest, "role not applicable to this resource")
|
||||
}
|
||||
}
|
||||
permissionsUpdated = true
|
||||
|
||||
} else if allowedResourceActions, ok = newPermission.GetLibreGraphPermissionsActionsOk(); ok && len(allowedResourceActions) > 0 {
|
||||
permissionsUpdated = true
|
||||
}
|
||||
|
||||
if permissionsUpdated {
|
||||
cs3UpdateOCMShareReq.Field = append(cs3UpdateOCMShareReq.Field, &ocm.UpdateOCMShareRequest_UpdateField{
|
||||
Field: &ocm.UpdateOCMShareRequest_UpdateField_AccessMethods{
|
||||
AccessMethods: &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_WebdavOptions{
|
||||
WebdavOptions: &ocm.WebDAVAccessMethod{
|
||||
Permissions: unifiedrole.PermissionsToCS3ResourcePermissions(
|
||||
[]*libregraph.UnifiedRolePermission{
|
||||
{
|
||||
AllowedResourceActions: allowedResourceActions,
|
||||
},
|
||||
},
|
||||
),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
updateOCMShareResp, err := gatewayClient.UpdateOCMShare(ctx, &cs3UpdateOCMShareReq)
|
||||
if err := errorcode.FromCS3Status(updateOCMShareResp.GetStatus(), err); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ocmShareResp, err := gatewayClient.GetOCMShare(ctx, &ocm.GetOCMShareRequest{
|
||||
Ref: &ocm.ShareReference{
|
||||
Spec: &ocm.ShareReference_Id{
|
||||
Id: &ocm.ShareId{
|
||||
OpaqueId: permissionID,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
if err := errorcode.FromCS3Status(ocmShareResp.GetStatus(), err); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
permission, err := g.cs3OCMShareToPermission(ctx, ocmShareResp.GetShare(), condition)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return permission, nil
|
||||
}
|
||||
|
||||
func (g BaseGraphService) updateUserShare(ctx context.Context, permissionID string, itemID *storageprovider.ResourceId, newPermission *libregraph.Permission) (*libregraph.Permission, error) {
|
||||
gatewayClient, err := g.gatewaySelector.Next()
|
||||
if err != nil {
|
||||
@@ -821,10 +1030,12 @@ func (g BaseGraphService) updateUserShare(ctx context.Context, permissionID stri
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
condition, err := roleConditionForResourceType(resourceInfo)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var cs3UpdateShareReq collaboration.UpdateShareRequest
|
||||
// When updating a space root we need to reference the share by resourceId and grantee
|
||||
if IsSpaceRoot(itemID) {
|
||||
|
||||
@@ -38,10 +38,6 @@ const (
|
||||
UnifiedRoleManagerID = "312c0871-5ef7-4b3a-85b6-0e4074c64049"
|
||||
// UnifiedRoleSecureViewerID Unified role secure viewer id.
|
||||
UnifiedRoleSecureViewerID = "aa97fe03-7980-45ac-9e50-b325749fd7e6"
|
||||
// UnifiedRoleFederatedViewerID Unified role federated viewer id.
|
||||
UnifiedRoleFederatedViewerID = "be531789-063c-48bf-a9fe-857e6fbee7da"
|
||||
// UnifiedRoleFederatedEditorID Unified role federated editor id.
|
||||
UnifiedRoleFederatedEditorID = "36279a93-e4e3-4bbb-8a23-53b05b560963"
|
||||
|
||||
// Wile the below conditions follow the SDDL syntax, they are not parsed anywhere. We use them as strings to
|
||||
// represent the constraints that a role definition applies to. For the actual syntax, see the SDDL documentation
|
||||
|
||||
@@ -65,14 +65,6 @@ var themeDefaults = KV{
|
||||
"label": "UnifiedRoleSecureView",
|
||||
"iconName": "shield",
|
||||
},
|
||||
unifiedrole.UnifiedRoleFederatedViewerID: KV{
|
||||
"label": "UnifiedRoleFederatedViewer",
|
||||
"iconName": "eye",
|
||||
},
|
||||
unifiedrole.UnifiedRoleFederatedEditorID: KV{
|
||||
"label": "UnifiedRoleFederatedEditor",
|
||||
"iconName": "pencil",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
+105
-5
@@ -31,14 +31,15 @@ import (
|
||||
ocm "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
|
||||
provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
|
||||
typespb "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
|
||||
"github.com/google/uuid"
|
||||
"github.com/pkg/errors"
|
||||
"google.golang.org/genproto/protobuf/field_mask"
|
||||
|
||||
"github.com/cs3org/reva/v2/pkg/errtypes"
|
||||
"github.com/cs3org/reva/v2/pkg/ocm/share"
|
||||
"github.com/cs3org/reva/v2/pkg/ocm/share/repository/registry"
|
||||
"github.com/cs3org/reva/v2/pkg/utils"
|
||||
"github.com/cs3org/reva/v2/pkg/utils/cfg"
|
||||
"github.com/google/uuid"
|
||||
"github.com/pkg/errors"
|
||||
"google.golang.org/genproto/protobuf/field_mask"
|
||||
)
|
||||
|
||||
func init() {
|
||||
@@ -381,8 +382,107 @@ func receivedShareEqual(ref *ocm.ShareReference, s *ocm.ReceivedShare) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
func (m *mgr) UpdateShare(ctx context.Context, user *userpb.User, ref *ocm.ShareReference, f ...*ocm.UpdateOCMShareRequest_UpdateField) (*ocm.Share, error) {
|
||||
return nil, errtypes.NotSupported("not yet implemented")
|
||||
// UpdateShare updates the share with the given fields.
|
||||
func (m *mgr) UpdateShare(ctx context.Context, user *userpb.User, ref *ocm.ShareReference, fields ...*ocm.UpdateOCMShareRequest_UpdateField) (*ocm.Share, error) {
|
||||
m.Lock()
|
||||
defer m.Unlock()
|
||||
if err := m.load(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, s := range m.model.Shares {
|
||||
if sharesEqual(ref, s) {
|
||||
if utils.UserEqual(user.Id, s.Owner) || utils.UserEqual(user.Id, s.Creator) {
|
||||
|
||||
for _, f := range fields {
|
||||
if exp := f.GetExpiration(); exp != nil {
|
||||
s.Expiration = exp
|
||||
}
|
||||
if am := f.GetAccessMethods(); am != nil {
|
||||
var (
|
||||
webdavOptions *ocm.WebDAVAccessMethod
|
||||
webappOptions *ocm.WebappAccessMethod
|
||||
transferOptions *ocm.TransferAccessMethod
|
||||
// TODO: *AccessMethod_GenericOptions
|
||||
|
||||
newWebdavOptions *ocm.WebDAVAccessMethod
|
||||
newWebappOptions *ocm.WebappAccessMethod
|
||||
newTransferOptions *ocm.TransferAccessMethod
|
||||
// TODO: *AccessMethod_GenericOptions
|
||||
)
|
||||
|
||||
for _, sm := range s.GetAccessMethods() {
|
||||
webdavOptions = sm.GetWebdavOptions()
|
||||
webappOptions = sm.GetWebappOptions()
|
||||
transferOptions = sm.GetTransferOptions()
|
||||
}
|
||||
|
||||
newWebdavOptions = am.GetWebdavOptions()
|
||||
newWebappOptions = am.GetWebappOptions()
|
||||
newTransferOptions = am.GetTransferOptions()
|
||||
|
||||
newAccesMethods := []*ocm.AccessMethod{}
|
||||
|
||||
if newWebdavOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_WebdavOptions{
|
||||
WebdavOptions: newWebdavOptions,
|
||||
},
|
||||
})
|
||||
} else if webdavOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_WebdavOptions{
|
||||
WebdavOptions: webdavOptions,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
if newWebappOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_WebappOptions{
|
||||
WebappOptions: newWebappOptions,
|
||||
},
|
||||
})
|
||||
} else if webappOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_WebappOptions{
|
||||
WebappOptions: webappOptions,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
if newTransferOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_TransferOptions{
|
||||
TransferOptions: newTransferOptions,
|
||||
},
|
||||
})
|
||||
} else if transferOptions != nil {
|
||||
newAccesMethods = append(newAccesMethods, &ocm.AccessMethod{
|
||||
Term: &ocm.AccessMethod_TransferOptions{
|
||||
TransferOptions: transferOptions,
|
||||
},
|
||||
})
|
||||
}
|
||||
s.AccessMethods = newAccesMethods
|
||||
}
|
||||
}
|
||||
|
||||
clone, err := cloneShare(s)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
m.model.Shares[s.Id.OpaqueId] = clone
|
||||
|
||||
if err := m.save(); err != nil {
|
||||
return nil, errors.Wrap(err, "error saving share")
|
||||
}
|
||||
|
||||
return clone, nil
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return nil, errtypes.NotFound(ref.String())
|
||||
}
|
||||
|
||||
func (m *mgr) ListShares(ctx context.Context, user *userpb.User, filters []*ocm.ListOCMSharesRequest_Filter) ([]*ocm.Share, error) {
|
||||
|
||||
Vendored
+1
-1
@@ -367,7 +367,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
|
||||
github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
|
||||
github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
|
||||
github.com/cs3org/go-cs3apis/cs3/types/v1beta1
|
||||
# github.com/cs3org/reva/v2 v2.23.1-0.20240905133054-2de6ff31c4e3
|
||||
# github.com/cs3org/reva/v2 v2.24.1-0.20240911132317-de8cea1f9e72
|
||||
## explicit; go 1.21
|
||||
github.com/cs3org/reva/v2/cmd/revad/internal/grace
|
||||
github.com/cs3org/reva/v2/cmd/revad/runtime
|
||||
|
||||
Reference in New Issue
Block a user