feat(sharing): Require service account to be configured for sharing service

In order to be able to run migrations, the "sharing" service now needs
the "service_account_id" and -"_secret" to be configured.

This is a "breaking/backwards incompatible" change.

opencloud/pkg/command/shares.go

@@ -85,12 +85,16 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 		return configlog.ReturnError(errors.New("cleanup is only implemented for the jsoncs3 share manager"))
 	}
 
+	l := logger()
+
+	zerolog.SetGlobalLevel(zerolog.InfoLevel)
+
 	rcfg := revaShareConfig(cfg.Sharing)
 	f, ok := registry.NewFuncs[driver]
 	if !ok {
 		return configlog.ReturnError(errors.New("Unknown share manager type '" + driver + "'"))
 	}
-	mgr, err := f(rcfg[driver].(map[string]any))
+	mgr, err := f(rcfg[driver].(map[string]any), l)
 	if err != nil {
 		return configlog.ReturnError(err)
 	}
@@ -115,10 +119,6 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 	if err != nil {
 		return configlog.ReturnError(err)
 	}
-
-	l := logger()
-
-	zerolog.SetGlobalLevel(zerolog.InfoLevel)
 	serviceUserCtx = l.WithContext(serviceUserCtx)
 
 	mgr.(*jsoncs3.Manager).CleanupStaleShares(serviceUserCtx)

opencloud/pkg/init/init.go

@@ -272,6 +272,9 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 		Activitylog: Activitylog{
 			ServiceAccount: serviceAccount,
 		},
+		Sharing: Sharing{
+			ServiceAccount: serviceAccount,
+		},
 	}
 
 	if insecure {

opencloud/pkg/init/structs.go

@@ -204,7 +204,8 @@ type SettingsService struct {
 
 // Sharing is the configuration for the sharing service
 type Sharing struct {
-	Events Events
+	Events         Events
+	ServiceAccount ServiceAccount `yaml:"service_account"`
 }
 
 // StorageRegistry is the configuration for the storage registry

services/sharing/pkg/config/config.go

@@ -18,7 +18,8 @@ type Config struct {
 	Reva         *shared.Reva  `yaml:"reva"`
 	Events       Events        `yaml:"events"`
 
-	SkipUserGroupsInToken bool `yaml:"skip_user_groups_in_token" env:"SHARING_SKIP_USER_GROUPS_IN_TOKEN" desc:"Disables the loading of user's group memberships from the reva access token." introductionVersion:"1.0.0"`
+	ServiceAccount        ServiceAccount `yaml:"service_account"`
+	SkipUserGroupsInToken bool           `yaml:"skip_user_groups_in_token" env:"SHARING_SKIP_USER_GROUPS_IN_TOKEN" desc:"Disables the loading of user's group memberships from the reva access token." introductionVersion:"1.0.0"`
 
 	UserSharingDriver              string               `yaml:"user_sharing_driver" env:"SHARING_USER_DRIVER" desc:"Driver to be used to persist shares. Supported values are 'jsoncs3', 'json', 'cs3' (deprecated) and 'owncloudsql'." introductionVersion:"1.0.0"`
 	UserSharingDrivers             UserSharingDrivers   `yaml:"user_sharing_drivers"`
@@ -100,6 +101,13 @@ type UserSharingJSONCS3Driver struct {
 	CacheTTL         int    `yaml:"cache_ttl" env:"SHARING_USER_JSONCS3_CACHE_TTL" desc:"TTL for the internal caches in seconds." introductionVersion:"1.0.0"`
 	MaxConcurrency   int    `yaml:"max_concurrency" env:"OC_MAX_CONCURRENCY;SHARING_USER_JSONCS3_MAX_CONCURRENCY" desc:"Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used." introductionVersion:"1.0.0"`
 }
+
+// ServiceAccount is the configuration for the used service account
+type ServiceAccount struct {
+	ServiceAccountID     string `yaml:"service_account_id" env:"OC_SERVICE_ACCOUNT_ID;SHARING_SERVICE_ACCOUNT" desc:"The ID of the service account the service should use. See the 'auth-service' service description for more details." introductionVersion:"%%NEXT%%"`
+	ServiceAccountSecret string `yaml:"service_account_secret" env:"OC_SERVICE_ACCOUNT_SECRET;SHARING_SERVICE_ACCOUNT_SECRET" desc:"The service account secret." introductionVersion:"%%NEXT%%"`
+}
+
 type PublicSharingDrivers struct {
 	JSON    PublicSharingJSONDriver    `yaml:"json"`
 	JSONCS3 PublicSharingJSONCS3Driver `yaml:"jsoncs3"`

services/sharing/pkg/config/parser/parse.go

@@ -58,5 +58,13 @@ func Validate(cfg *config.Config) error {
 		return shared.MissingSystemUserID(cfg.Service.Name)
 	}
 
+	if cfg.ServiceAccount.ServiceAccountID == "" {
+		return shared.MissingServiceAccountID(cfg.Service.Name)
+	}
+
+	if cfg.ServiceAccount.ServiceAccountSecret == "" {
+		return shared.MissingServiceAccountSecret(cfg.Service.Name)
+	}
+
 	return nil
 }

services/sharing/pkg/revaconfig/config.go

@@ -71,13 +71,15 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 							"machine_auth_apikey": cfg.UserSharingDrivers.CS3.SystemUserAPIKey,
 						},
 						"jsoncs3": map[string]any{
-							"gateway_addr":        cfg.Reva.Address,
-							"provider_addr":       cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
-							"service_user_id":     cfg.UserSharingDrivers.JSONCS3.SystemUserID,
-							"service_user_idp":    cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
-							"machine_auth_apikey": cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
-							"ttl":                 cfg.UserSharingDrivers.JSONCS3.CacheTTL,
-							"max_concurrency":     cfg.UserSharingDrivers.JSONCS3.MaxConcurrency,
+							"gateway_addr":           cfg.Reva.Address,
+							"provider_addr":          cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
+							"system_user_id":         cfg.UserSharingDrivers.JSONCS3.SystemUserID,
+							"system_user_idp":        cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
+							"machine_auth_apikey":    cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
+							"ttl":                    cfg.UserSharingDrivers.JSONCS3.CacheTTL,
+							"max_concurrency":        cfg.UserSharingDrivers.JSONCS3.MaxConcurrency,
+							"service_account_id":     cfg.ServiceAccount.ServiceAccountID,
+							"service_account_secret": cfg.ServiceAccount.ServiceAccountSecret,
 							"events": map[string]any{
 								"natsaddress":          cfg.Events.Addr,
 								"natsclusterid":        cfg.Events.ClusterID,