reva/frontend: Add capabilities to indicate attributes that are read-only.

services/frontend/README.md

@@ -1,6 +1,6 @@
 # Frontend
 
-The frontend service translates various owncloud related HTTP APIs to CS3 requests. 
+The frontend service translates various owncloud related HTTP APIs to CS3 requests.
 
 ## Endpoints Overview
 
@@ -25,3 +25,22 @@ The ocs endpoint, by default `/ocs`, implements the ownCloud 10 Open Collaborati
 ## Scalability
 
 While the frontend service does not persist any data it does cache `Stat()` responses and user information. Therefore, multiple instances of this service can be spawned in a bigger deployment like when using container orchestration with Kubernetes, when configuring `FRONTEND_OCS_RESOURCE_INFO_CACHE_TYPE=redis` and the related config options.
+
+## libregraph service interactions
+
+A lot of user management is done via a standardized libregraph API.
+Depending on how the system is configured there might be some attributes
+for users that an instance admin user can't change because of properties
+coming from an external LDAP server, or similar. To make life easier for
+admin users there are hints as capabilites telling which attributes are
+read-only or not. To configure these hints we have the following
+environment variables:
+
+- FRONTEND_READONLY_ATTRIBUTES_ACCOUNT_ENABLED: Default is false
+- FRONTEND_READONLY_ATTRIBUTES_DISPLAY_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_GIVEN_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_ID: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_MAIL: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_ON_PREMISES_SAM_ACCOUNT_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_SURNAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_QUOTA: Default is false

services/frontend/pkg/config/config.go

@@ -39,11 +39,12 @@ type Config struct {
 
 	PublicURL string `yaml:"public_url" env:"OCIS_URL;FRONTEND_PUBLIC_URL" desc:"The public facing URL of the oCIS frontend."`
 
-	AppHandler  AppHandler  `yaml:"app_handler"`
+	AppHandler          AppHandler          `yaml:"app_handler"`
-	Archiver    Archiver    `yaml:"archiver"`
+	Archiver            Archiver            `yaml:"archiver"`
-	DataGateway DataGateway `yaml:"data_gateway"`
+	DataGateway         DataGateway         `yaml:"data_gateway"`
-	OCS         OCS         `yaml:"ocs"`
+	OCS                 OCS                 `yaml:"ocs"`
-	Checksums   Checksums   `yaml:"checksums"`
+	Checksums           Checksums           `yaml:"checksums"`
+	ReadyOnlyAttributes ReadyOnlyAttributes `yaml:"read_only_attributes"`
 
 	Middleware Middleware `yaml:"middleware"`
 
@@ -160,3 +161,14 @@ type Checksums struct {
 	SupportedTypes      []string `yaml:"supported_types" env:"FRONTEND_CHECKSUMS_SUPPORTED_TYPES" desc:"Define the checksum types that indicate to clients which hashes the server can use to verify upload integrity. You can provide multiple types separated by blank or comma. Supported types are 'sha1', 'md5' and 'adler32'."`
 	PreferredUploadType string   `yaml:"preferred_upload_type" env:"FRONTEND_CHECKSUMS_PREFERRED_UPLOAD_TYPE" desc:"The supported checksum type for uploads that indicates to clients supporting multiple hash algorithms which one is preferred by the server. Must be one out of the defined list of SUPPORTED_TYPES."`
 }
+
+type ReadyOnlyAttributes struct {
+	AccountEnabled           bool `yaml:"account_enabled" env:"FRONTEND_READONLY_ATTRIBUTES_ACCOUNT_ENABLED" desc:"Flag to indicate if account_enabled attribute is read-only. Default is false."`
+	DisplayName              bool `yaml:"display_name" env:"FRONTEND_READONLY_ATTRIBUTES_DISPLAY_NAME" desc:"Flag to indicate if display_name attribute is read-only. Default is true."`
+	GivenName                bool `yaml:"given_name" env:"FRONTEND_READONLY_ATTRIBUTES_GIVEN_NAME" desc:"Flag to indicate if given_name attribute is read-only. Default is true."`
+	ID                       bool `yaml:"id" env:"FRONTEND_READONLY_ATTRIBUTES_ID" desc:"Flag to indicate if id attribute is read-only. Default is true."`
+	Mail                     bool `yaml:"mail" env:"FRONTEND_READONLY_ATTRIBUTES_MAIL" desc:"Flag to indicate if mail attribute is read-only. Default is true."`
+	OnPremisesSamAccountName bool `yaml:"on_premises_sam_account_name" env:"FRONTEND_READONLY_ATTRIBUTES_ON_PREMISES_SAM_ACCOUNT_NAME" desc:"Flag to indicate if on_premises_sam_account_name attribute is read-only. Default is true."`
+	Surname                  bool `yaml:"surname" env:"FRONTEND_READONLY_ATTRIBUTES_SURNAME" desc:"Flag to indicate if surname attribute is read-only.  Default is true."`
+	Quota                    bool `yaml:"quota" env:"FRONTEND_READONLY_ATTRIBUTES_QUOTA" desc:"Flag to indicate if quota attribute read-only. Default is false."`
+}

services/frontend/pkg/config/defaults/defaultconfig.go

@@ -89,6 +89,16 @@ func DefaultConfig() *config.Config {
 			SupportedTypes:      []string{"sha1", "md5", "adler32"},
 			PreferredUploadType: "sha1",
 		},
+		ReadyOnlyAttributes: config.ReadyOnlyAttributes{
+			AccountEnabled:           false,
+			DisplayName:              true,
+			GivenName:                true,
+			ID:                       true,
+			Mail:                     true,
+			OnPremisesSamAccountName: true,
+			Surname:                  true,
+			Quota:                    false,
+		},
 		AppHandler: config.AppHandler{
 			Prefix: "app",
 		},

services/frontend/pkg/revaconfig/config.go

@@ -63,6 +63,24 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 		}
 	}
 
+	read_only_attributes_map := map[string]bool{
+		"account_enabled":              cfg.ReadyOnlyAttributes.AccountEnabled,
+		"display_name":                 cfg.ReadyOnlyAttributes.DisplayName,
+		"given_name":                   cfg.ReadyOnlyAttributes.GivenName,
+		"id":                           cfg.ReadyOnlyAttributes.ID,
+		"mail":                         cfg.ReadyOnlyAttributes.Mail,
+		"on_premises_sam_account_name": cfg.ReadyOnlyAttributes.OnPremisesSamAccountName,
+		"surname":                      cfg.ReadyOnlyAttributes.Surname,
+		"quota":                        cfg.ReadyOnlyAttributes.Quota,
+	}
+
+	var read_only_attributes []string
+	for k, v := range read_only_attributes_map {
+		if v {
+			read_only_attributes = append(read_only_attributes, k)
+		}
+	}
+
 	return map[string]interface{}{
 		"core": map[string]interface{}{
 			"tracing_enabled":      cfg.Tracing.Enabled,
@@ -199,6 +217,7 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 							},
 							"graph": map[string]interface{}{
 								"personal_data_export": true,
+								"read_only_attributes": read_only_attributes,
 							},
 							"checksums": map[string]interface{}{
 								"supported_types":       cfg.Checksums.SupportedTypes,