sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename go-micro services

Browse Source
This commit is contained in:
Ralf Haferkamp
2025-01-16 09:45:46 +01:00
parent caa3121edf
commit 213e9663a9
79 changed files with 203 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/proxy/README.md
+8 -8
View File
@@ -15,7 +15,7 @@ The following request authentication schemes are implemented:
## Configuring Routes
The proxy handles routing to all endpoints that ocis offers. The currently availabe default routes can be found [in the code](https://github.com/owncloud/ocis/blob/master/services/proxy/pkg/config/defaults/defaultconfig.go). Changing or adding routes can be necessary when writing own ocis extensions.
The proxy handles routing to all endpoints that ocis offers. The currently availabe default routes can be found [in the code](https://github.eu.opencloud.ocis/blob/master/services/proxy/pkg/config/defaults/defaultconfig.go). Changing or adding routes can be necessary when writing own ocis extensions.
Due to the complexity when defining routes, these can only be defined in the yaml file but not via environment variables.
@@ -26,9 +26,9 @@ policies:
- name: ocis
routes:
- endpoint: /
service: com.owncloud.web.web
service: eu.opencloud.web.web
- endpoint: /dav/
service: com.owncloud.web.ocdav
service: eu.opencloud.web.ocdav
```
For adding _additional_ routes to the default routes use:
@@ -38,7 +38,7 @@ additional_policies:
- name: ocis
routes:
- endpoint: /custom/endpoint
service: com.owncloud.custom.custom
service: eu.opencloud.custom.custom
```
A route has the following configurable parameters:
@@ -140,14 +140,14 @@ These issued JWT tokens are immutable and integrity-protected. Which means, any
* Infinite Scale can't differentiate between a group being renamed in the IDP and users being reassigned to a different group.
* Infinite Scale does not get aware when a group is being deleted in the IDP, a new claim will not hold any information from the deleted group. Infinite Scale does not track a claim history to compare.
* Infinite Scale does not get aware when a group is being deleted in the IDP, a new claim will not hold any information from the deleted group. Infinite Scale does not track a claim history to compare.
#### Impacts
For shares or space memberships based on groups, a renamed or deleted group will impact accessing the resource:
* There is no user notification about the inability accessing the resource.
* The user will only experience rejected access.
* The user will only experience rejected access.
* This also applies for connected apps like the Desktop, iOS or Android app!
To give access for rejected users on a resource, one with rights to share must update the group information.
@@ -266,7 +266,7 @@ Store specific notes:
To authenticate presigned URLs the proxy service needs to read signing keys from a store that is populated by the ocs service. Possible stores are:
- `nats-js-kv`: Stores data using key-value-store feature of [nats jetstream](https://docs.nats.io/nats-concepts/jetstream/key-value-store)
- `redis-sentinel`: Stores data in a configured Redis Sentinel cluster.
- `ocisstoreservice`: Stores data in the legacy ocis store service. Requires setting `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES` to `com.owncloud.api.store`.
- `ocisstoreservice`: Stores data in the legacy ocis store service. Requires setting `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES` to `eu.opencloud.api.store`.
The `memory` store cannot be used as it does not share the memory from the ocs service signing key memory store, even in a single process.
@@ -276,7 +276,7 @@ Store specific notes:
- When using `redis-sentinel`, the Redis master to use is configured via e.g. `OC_CACHE_STORE_NODES` in the form of `<sentinel-host>:<sentinel-port>/<redis-master>` like `10.10.0.200:26379/mymaster`.
- When using `nats-js-kv` it is recommended to set `OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES` to the same value as `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES`. That way the ocs uses the same nats instance as the proxy service.
- When using the `nats-js-kv` store, it is possible to set `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_DISABLE_PERSISTENCE` to instruct nats to not persist signing key data on disc.
- When using `ocisstoreservice` the `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES` must be set to the service name `com.owncloud.api.store`. It does not support TTL and stores the presigning keys indefinitely. Also, the store service needs to be started.
- When using `ocisstoreservice` the `PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES` must be set to the service name `eu.opencloud.api.store`. It does not support TTL and stores the presigning keys indefinitely. Also, the store service needs to be started.
## Special Settings
services/proxy/pkg/command/server.go
+2 -2
View File
@@ -247,8 +247,8 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
userProvider backend.UserBackend, publisher events.Publisher,
gatewaySelector pool.Selectable[gateway.GatewayAPIClient], serviceSelector selector.Selector) alice.Chain {
rolesClient := settingssvc.NewRoleService("com.owncloud.api.settings", cfg.GrpcClient)
policiesProviderClient := policiessvc.NewPoliciesProviderService("com.owncloud.api.policies", cfg.GrpcClient)
rolesClient := settingssvc.NewRoleService("eu.opencloud.api.settings", cfg.GrpcClient)
policiesProviderClient := policiessvc.NewPoliciesProviderService("eu.opencloud.api.policies", cfg.GrpcClient)
var roleAssigner userroles.UserRoleAssigner
switch cfg.RoleAssignment.Driver {
services/proxy/pkg/config/defaults/defaultconfig.go
+35 -35
View File
@@ -31,7 +31,7 @@ func DefaultConfig() *config.Config {
HTTP: config.HTTP{
Addr: "0.0.0.0:9200",
Root: "/",
Namespace: "com.owncloud.web",
Namespace: "eu.opencloud.web",
TLSCert: path.Join(defaults.BaseDataPath(), "proxy", "server.crt"),
TLSKey: path.Join(defaults.BaseDataPath(), "proxy", "server.key"),
TLS: true,
@@ -111,79 +111,79 @@ func DefaultPolicies() []config.Policy {
Routes: []config.Route{
{
Endpoint: "/",
Service: "com.owncloud.web.web",
Service: "eu.opencloud.web.web",
Unprotected: true,
},
{
Endpoint: "/.well-known/ocm",
Service: "com.owncloud.web.ocm",
Service: "eu.opencloud.web.ocm",
Unprotected: true,
},
{
Endpoint: "/.well-known/webfinger",
Service: "com.owncloud.web.webfinger",
Service: "eu.opencloud.web.webfinger",
Unprotected: true,
},
{
Endpoint: "/.well-known/openid-configuration",
Service: "com.owncloud.web.idp",
Service: "eu.opencloud.web.idp",
Unprotected: true,
},
{
Endpoint: "/branding/logo",
Service: "com.owncloud.web.web",
Service: "eu.opencloud.web.web",
},
{
Endpoint: "/konnect/",
Service: "com.owncloud.web.idp",
Service: "eu.opencloud.web.idp",
Unprotected: true,
},
{
Endpoint: "/signin/",
Service: "com.owncloud.web.idp",
Service: "eu.opencloud.web.idp",
Unprotected: true,
},
{
Endpoint: "/archiver",
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
},
{
// reroute oc10 notifications endpoint to userlog service
Endpoint: "/ocs/v2.php/apps/notifications/api/v1/notifications/sse",
Service: "com.owncloud.sse.sse",
Service: "eu.opencloud.sse.sse",
},
{
// reroute oc10 notifications endpoint to userlog service
Endpoint: "/ocs/v2.php/apps/notifications/api/v1/notifications",
Service: "com.owncloud.web.userlog",
Service: "eu.opencloud.web.userlog",
},
{
Type: config.RegexRoute,
Endpoint: "/ocs/v[12].php/cloud/user/signing-key", // only `user/signing-key` is left in ocis-ocs
Service: "com.owncloud.web.ocs",
Service: "eu.opencloud.web.ocs",
},
{
Type: config.RegexRoute,
Endpoint: "/ocs/v[12].php/config",
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
Unprotected: true,
},
{
Endpoint: "/sciencemesh/",
Service: "com.owncloud.web.ocm",
Service: "eu.opencloud.web.ocm",
},
{
Endpoint: "/ocm/",
Service: "com.owncloud.web.ocm",
Service: "eu.opencloud.web.ocm",
},
{
Endpoint: "/ocs/",
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
},
{
Type: config.QueryRoute,
Endpoint: "/remote.php/?preview=1",
Service: "com.owncloud.web.webdav",
Service: "eu.opencloud.web.webdav",
},
// TODO the actual REPORT goes to /dav/files/{username}, which is user specific ... how would this work in a spaces world?
// TODO what paths are returned? the href contains the full path so it should be possible to return urls from other spaces?
@@ -193,81 +193,81 @@ func DefaultPolicies() []config.Policy {
Type: config.RegexRoute,
Method: "REPORT",
Endpoint: "(/remote.php)?/(web)?dav",
Service: "com.owncloud.web.webdav",
Service: "eu.opencloud.web.webdav",
},
{
Type: config.QueryRoute,
Endpoint: "/dav/?preview=1",
Service: "com.owncloud.web.webdav",
Service: "eu.opencloud.web.webdav",
},
{
Type: config.QueryRoute,
Endpoint: "/webdav/?preview=1",
Service: "com.owncloud.web.webdav",
Service: "eu.opencloud.web.webdav",
},
{
Endpoint: "/remote.php/",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
},
{
Endpoint: "/dav/",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
},
{
Endpoint: "/webdav/",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
},
{
Endpoint: "/status",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
Unprotected: true,
},
{
Endpoint: "/status.php",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
Unprotected: true,
},
{
Endpoint: "/index.php/",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
},
{
Endpoint: "/apps/",
Service: "com.owncloud.web.ocdav",
Service: "eu.opencloud.web.ocdav",
},
{
Endpoint: "/data",
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
Unprotected: true,
},
{
Endpoint: "/app/list",
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
Unprotected: true,
},
{
Endpoint: "/app/", // /app or /apps? ocdav only handles /apps
Service: "com.owncloud.web.frontend",
Service: "eu.opencloud.web.frontend",
},
{
Endpoint: "/graph/v1beta1/extensions/org.libregraph/activities",
Service: "com.owncloud.web.activitylog",
Service: "eu.opencloud.web.activitylog",
},
{
Endpoint: "/graph/v1.0/invitations",
Service: "com.owncloud.web.invitations",
Service: "eu.opencloud.web.invitations",
},
{
Endpoint: "/graph/",
Service: "com.owncloud.web.graph",
Service: "eu.opencloud.web.graph",
},
{
Endpoint: "/api/v0/settings",
Service: "com.owncloud.web.settings",
Service: "eu.opencloud.web.settings",
},
{
Endpoint: "/auth-app/tokens",
Service: "com.owncloud.web.auth-app",
Service: "eu.opencloud.web.auth-app",
},
},
},
services/proxy/pkg/middleware/app_auth_test.go
+2 -2
View File
@@ -17,12 +17,12 @@ import (
var _ = Describe("Authenticating requests", Label("AppAuthAuthenticator"), func() {
var authenticator Authenticator
BeforeEach(func() {
pool.RemoveSelector("GatewaySelector" + "com.owncloud.api.gateway")
pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
authenticator = AppAuthAuthenticator{
Logger: log.NewLogger(),
RevaGatewaySelector: pool.GetSelector[gateway.GatewayAPIClient](
"GatewaySelector",
"com.owncloud.api.gateway",
"eu.opencloud.api.gateway",
func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
return mockGatewayClient{
AuthenticateFunc: func(authType, clientID, clientSecret string) (string, rpcv1beta1.Code) {
services/proxy/pkg/middleware/authentication_test.go
+2 -2
View File
@@ -72,7 +72,7 @@ var _ = Describe("Authenticating requests", Label("Authentication"), func() {
ub.On("Authenticate", mock.Anything, mock.Anything, mock.Anything).Return(nil, "", backend.ErrAccountNotFound)
BeforeEach(func() {
pool.RemoveSelector("GatewaySelector" + "com.owncloud.api.gateway")
pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
logger := log.NewLogger()
authenticators = []Authenticator{
@@ -91,7 +91,7 @@ var _ = Describe("Authenticating requests", Label("Authentication"), func() {
Logger: logger,
RevaGatewaySelector: pool.GetSelector[gateway.GatewayAPIClient](
"GatewaySelector",
"com.owncloud.api.gateway",
"eu.opencloud.api.gateway",
func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
return mockGatewayClient{
AuthenticateFunc: func(authType, clientID, clientSecret string) (string, rpcv1beta1.Code) {
services/proxy/pkg/middleware/policies_test.go
+2 -2
View File
@@ -146,12 +146,12 @@ func prepare(q string) (http.Handler, *mocks.PoliciesProviderService, *cs3mocks.
gatewayClient := &cs3mocks.GatewayAPIClient{}
gatewaySelector := pool.GetSelector[gateway.GatewayAPIClient](
"GatewaySelector",
"com.owncloud.api.gateway",
"eu.opencloud.api.gateway",
func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
return gatewayClient
},
)
defer pool.RemoveSelector("GatewaySelector" + "com.owncloud.api.gateway")
defer pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
// mocked policiesProviderService
policiesProviderService := &mocks.PoliciesProviderService{}
services/proxy/pkg/middleware/public_share_auth_test.go
+2 -2
View File
@@ -18,12 +18,12 @@ import (
var _ = Describe("Authenticating requests", Label("PublicShareAuthenticator"), func() {
var authenticator Authenticator
BeforeEach(func() {
pool.RemoveSelector("GatewaySelector" + "com.owncloud.api.gateway")
pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
authenticator = PublicShareAuthenticator{
Logger: log.NewLogger(),
RevaGatewaySelector: pool.GetSelector[gateway.GatewayAPIClient](
"GatewaySelector",
"com.owncloud.api.gateway",
"eu.opencloud.api.gateway",
func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
return mockGatewayClient{
AuthenticateFunc: func(authType, clientID, clientSecret string) (string, rpcv1beta1.Code) {
services/proxy/pkg/user/backend/cs3.go
+1 -1
View File
@@ -427,7 +427,7 @@ func (c cs3backend) updateLibregraphUser(userid string, user libregraph.UserUpda
func (c cs3backend) setupLibregraphClient(_ context.Context, cs3token string) (*libregraph.APIClient, error) {
// Use micro registry to resolve next graph service endpoint
next, err := c.graphSelector.Select("com.owncloud.web.graph")
next, err := c.graphSelector.Select("eu.opencloud.web.graph")
if err != nil {
c.logger.Debug().Err(err).Msg("setupLibregraphClient: error during Select")
return nil, err