bump reva to lastest main

for https://github.com/opencloud-eu/reva/pull/372

vendor/github.com/go-playground/validator/v10/README.md

@@ -106,8 +106,9 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | datauri | Data URL |
 | fqdn | Full Qualified Domain Name (FQDN) |
 | hostname | Hostname RFC 952 |
-| hostname_port | HostPort |
 | hostname_rfc1123 | Hostname RFC 1123 |
+| hostname_port | HostPort |
+| port | Port number |
 | ip | Internet Protocol Address IP |
 | ip4_addr | Internet Protocol Address IPv4 |
 | ip6_addr | Internet Protocol Address IPv6 |
@@ -124,7 +125,8 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | unix_addr | Unix domain socket end point Address |
 | uri | URI String |
 | url | URL String |
-| http_url | HTTP URL String |
+| http_url | HTTP(s) URL String |
+| https_url | HTTPS-only URL String |
 | url_encoded | URL Encoded |
 | urn_rfc2141 | Urn RFC 2141 String |
 
@@ -133,6 +135,7 @@ validate := validator.New(validator.WithRequiredStructEnabled())
 | Tag | Description |
 | - | - |
 | alpha | Alpha Only |
+| alphaspace | Alpha Space |
 | alphanum | Alphanumeric |
 | alphanumunicode | Alphanumeric Unicode |
 | alphaunicode | Alpha Unicode |

vendor/github.com/go-playground/validator/v10/baked_in.go

@@ -118,6 +118,7 @@ var (
 		"fieldcontains":                 fieldContains,
 		"fieldexcludes":                 fieldExcludes,
 		"alpha":                         isAlpha,
+		"alphaspace":                    isAlphaSpace,
 		"alphanum":                      isAlphanum,
 		"alphaunicode":                  isAlphaUnicode,
 		"alphanumunicode":               isAlphanumUnicode,
@@ -134,6 +135,7 @@ var (
 		"email":                         isEmail,
 		"url":                           isURL,
 		"http_url":                      isHttpURL,
+		"https_url":                     isHttpsURL,
 		"uri":                           isURI,
 		"urn_rfc2141":                   isUrnRFC2141, // RFC 2141
 		"file":                          isFile,
@@ -1513,6 +1515,29 @@ func isHttpURL(fl FieldLevel) bool {
 	panic(fmt.Sprintf("Bad field type %s", field.Type()))
 }
 
+// isHttpsURL is the validation function for validating if the current field's value is a valid HTTPS-only URL.
+func isHttpsURL(fl FieldLevel) bool {
+	if !isURL(fl) {
+		return false
+	}
+
+	field := fl.Field()
+	switch field.Kind() {
+	case reflect.String:
+
+		s := strings.ToLower(field.String())
+
+		url, err := url.Parse(s)
+		if err != nil || url.Host == "" {
+			return false
+		}
+
+		return url.Scheme == "https"
+	}
+
+	panic(fmt.Sprintf("Bad field type %s", field.Type()))
+}
+
 // isUrnRFC2141 is the validation function for validating if the current field's value is a valid URN as per RFC 2141.
 func isUrnRFC2141(fl FieldLevel) bool {
 	field := fl.Field()
@@ -1743,6 +1768,11 @@ func isAlphanumUnicode(fl FieldLevel) bool {
 	return alphaUnicodeNumericRegex().MatchString(fl.Field().String())
 }
 
+// isAlphaSpace is the validation function for validating if the current field's value is a valid alpha value with spaces.
+func isAlphaSpace(fl FieldLevel) bool {
+	return alphaSpaceRegex().MatchString(fl.Field().String())
+}
+
 // isAlphaUnicode is the validation function for validating if the current field's value is a valid alpha unicode value.
 func isAlphaUnicode(fl FieldLevel) bool {
 	return alphaUnicodeRegex().MatchString(fl.Field().String())
@@ -1872,6 +1902,15 @@ func requiredIf(fl FieldLevel) bool {
 	if len(params)%2 != 0 {
 		panic(fmt.Sprintf("Bad param number for required_if %s", fl.FieldName()))
 	}
+
+	seen := make(map[string]struct{})
+	for i := 0; i < len(params); i += 2 {
+		if _, ok := seen[params[i]]; ok {
+			panic(fmt.Sprintf("Duplicate param %s for required_if %s", params[i], fl.FieldName()))
+		}
+		seen[params[i]] = struct{}{}
+	}
+
 	for i := 0; i < len(params); i += 2 {
 		if !requireCheckFieldValue(fl, params[i], params[i+1], false) {
 			return true

vendor/github.com/go-playground/validator/v10/doc.go

@@ -264,6 +264,7 @@ The field under validation must be present and not empty only if all
 the other specified fields are equal to the value following the specified
 field. For strings ensures value is not "". For slices, maps, pointers,
 interfaces, channels and functions ensures the value is not nil. For structs ensures value is not the zero value.
+Using the same field name multiple times in the parameters will result in a panic at runtime.
 
 	Usage: required_if
 
@@ -776,6 +777,12 @@ This validates that a string value contains ASCII alpha characters only
 
 	Usage: alpha
 
+# Alpha Space
+
+This validates that a string value contains ASCII alpha characters and spaces only
+
+	Usage: alphaspace
+
 # Alphanumeric
 
 This validates that a string value contains ASCII alphanumeric characters only
@@ -1330,6 +1337,12 @@ can be used to validate fields typically passed to sockets and connections.
 
 	Usage: hostname_port
 
+# Port
+
+This validates that the value falls within the valid port number range of 1 to 65,535.
+
+	Usage: port
+
 # Datetime
 
 This validates that a string value is a valid datetime based on the supplied datetime format.

vendor/github.com/go-playground/validator/v10/regexes.go

@@ -7,6 +7,7 @@ import (
 
 const (
 	alphaRegexString                 = "^[a-zA-Z]+$"
+	alphaSpaceRegexString            = "^[a-zA-Z ]+$"
 	alphaNumericRegexString          = "^[a-zA-Z0-9]+$"
 	alphaUnicodeRegexString          = "^[\\p{L}]+$"
 	alphaUnicodeNumericRegexString   = "^[\\p{L}\\p{N}]+$"
@@ -93,6 +94,7 @@ func lazyRegexCompile(str string) func() *regexp.Regexp {
 
 var (
 	alphaRegex                 = lazyRegexCompile(alphaRegexString)
+	alphaSpaceRegex            = lazyRegexCompile(alphaSpaceRegexString)
 	alphaNumericRegex          = lazyRegexCompile(alphaNumericRegexString)
 	alphaUnicodeRegex          = lazyRegexCompile(alphaUnicodeRegexString)
 	alphaUnicodeNumericRegex   = lazyRegexCompile(alphaUnicodeNumericRegexString)

vendor/github.com/go-playground/validator/v10/validator_instance.go

@@ -181,7 +181,7 @@ func (v Validate) ValidateMapCtx(ctx context.Context, data map[string]interface{
 				errs[field] = errors.New("The field: '" + field + "' is not a map to dive")
 			}
 		} else if ruleStr, ok := rule.(string); ok {
-			err := v.VarCtx(ctx, data[field], ruleStr)
+			err := v.VarWithKeyCtx(ctx, field, data[field], ruleStr)
 			if err != nil {
 				errs[field] = err
 			}
@@ -681,6 +681,64 @@ func (v *Validate) VarWithValueCtx(ctx context.Context, field interface{}, other
 	return
 }
 
+// VarWithKey validates a single variable with a key to be included in the returned error using tag style validation
+// eg.
+// var s string
+// validate.VarWithKey("email_address", s, "required,email")
+//
+// WARNING: a struct can be passed for validation eg. time.Time is a struct or
+// if you have a custom type and have registered a custom type handler, so must
+// allow it; however unforeseen validations will occur if trying to validate a
+// struct that is meant to be passed to 'validate.Struct'
+//
+// It returns InvalidValidationError for bad values passed in and nil or ValidationErrors as error otherwise.
+// You will need to assert the error if it's not nil eg. err.(validator.ValidationErrors) to access the array of errors.
+// validate Array, Slice and maps fields which may contain more than one error
+func (v *Validate) VarWithKey(key string, field interface{}, tag string) error {
+	return v.VarWithKeyCtx(context.Background(), key, field, tag)
+}
+
+// VarWithKeyCtx validates a single variable with a key to be included in the returned error using tag style validation
+// and allows passing of contextual validation information via context.Context.
+// eg.
+// var s string
+// validate.VarWithKeyCtx("email_address", s, "required,email")
+//
+// WARNING: a struct can be passed for validation eg. time.Time is a struct or
+// if you have a custom type and have registered a custom type handler, so must
+// allow it; however unforeseen validations will occur if trying to validate a
+// struct that is meant to be passed to 'validate.Struct'
+//
+// It returns InvalidValidationError for bad values passed in and nil or ValidationErrors as error otherwise.
+// You will need to assert the error if it's not nil eg. err.(validator.ValidationErrors) to access the array of errors.
+// validate Array, Slice and maps fields which may contain more than one error
+func (v *Validate) VarWithKeyCtx(ctx context.Context, key string, field interface{}, tag string) (err error) {
+	if len(tag) == 0 || tag == skipValidationTag {
+		return nil
+	}
+
+	ctag := v.fetchCacheTag(tag)
+
+	cField := &cField{
+		name:       key,
+		altName:    key,
+		namesEqual: true,
+	}
+
+	val := reflect.ValueOf(field)
+	vd := v.pool.Get().(*validate)
+	vd.top = val
+	vd.isPartial = false
+	vd.traverseField(ctx, val, val, vd.ns[0:0], vd.actualNs[0:0], cField, ctag)
+
+	if len(vd.errs) > 0 {
+		err = vd.errs
+		vd.errs = nil
+	}
+	v.pool.Put(vd)
+	return
+}
+
 func (v *Validate) registerValidation(tag string, fn FuncCtx, bakedIn bool, nilCheckable bool) error {
 	if len(tag) == 0 {
 		return errors.New("function Key cannot be empty")

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/storageprovider/storageprovider.go

@@ -1115,6 +1115,13 @@ func (s *Service) AddGrant(ctx context.Context, req *provider.AddGrantRequest) (
 		ctx = WithSpaceType(ctx, utils.ReadPlainFromOpaque(req.Opaque, "spacetype"))
 	}
 
+	// error out if no permissions are set
+	if req.GetGrant().GetPermissions() == nil {
+		return &provider.AddGrantResponse{
+			Status: status.NewInvalid(ctx, "permissions are invalid"),
+		}, nil
+	}
+
 	// check grantee type is valid
 	if req.Grant.Grantee.Type == provider.GranteeType_GRANTEE_TYPE_INVALID {
 		return &provider.AddGrantResponse{
@@ -1122,6 +1129,13 @@ func (s *Service) AddGrant(ctx context.Context, req *provider.AddGrantRequest) (
 		}, nil
 	}
 
+	// check if grantee has an id
+	if req.GetGrant().GetGrantee().GetId() == nil {
+		return &provider.AddGrantResponse{
+			Status: status.NewInvalid(ctx, "grantee id is invalid"),
+		}, nil
+	}
+
 	err := s.Storage.AddGrant(ctx, req.Ref, req.Grant)
 
 	return &provider.AddGrantResponse{

vendor/github.com/opencloud-eu/reva/v2/pkg/group/manager/ldap/ldap.go

@@ -35,7 +35,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 )
 
@@ -63,8 +62,7 @@ func parseConfig(m map[string]interface{}) (*config, error) {
 		LDAPIdentity: ldapIdentity.New(),
 	}
 	if err := mapstructure.Decode(m, &c); err != nil {
-		err = errors.Wrap(err, "error decoding conf")
-		return nil, err
+		return nil, fmt.Errorf("error decoding conf: %w", err)
 	}
 
 	return &c, nil

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/grants.go

@@ -28,6 +28,7 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/appctx"
 	ctxpkg "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/node"
@@ -118,6 +119,20 @@ func (fs *Decomposedfs) AddGrant(ctx context.Context, ref *provider.Reference, g
 		}
 	}
 
+	if sharedconf.MultiTenantEnabled() {
+		spaceTenant, err := grantNode.SpaceRoot.XattrString(ctx, prefixes.SpaceTenantIDAttr)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to read tenant id of space")
+			return errtypes.InternalError("error validating tenantID")
+		}
+		if g.Grantee.Type == provider.GranteeType_GRANTEE_TYPE_USER {
+			if g.Grantee.GetUserId().GetTenantId() != spaceTenant {
+				log.Error().Str("spaceTenant", spaceTenant).Str("granteeTenant", g.Grantee.GetUserId().GetTenantId()).Msg("cannot add grant for user from different tenant")
+				return errtypes.PermissionDenied("cannot add grant for user from different tenant")
+			}
+		}
+	}
+
 	return fs.storeGrant(ctx, grantNode, g)
 }
 

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes/prefixes.go

@@ -97,6 +97,7 @@ const (
 	SpaceReadmeAttr      string = OcPrefix + "space.readme"
 	SpaceImageAttr       string = OcPrefix + "space.image"
 	SpaceAliasAttr       string = OcPrefix + "space.alias"
+	SpaceTenantIDAttr    string = OcPrefix + "space.tenantid"
 
 	UserAcePrefix  string = "u:"
 	GroupAcePrefix string = "g:"

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/spaces.go

@@ -147,7 +147,11 @@ func (fs *Decomposedfs) CreateStorageSpace(ctx context.Context, req *provider.Cr
 	if req.GetOwner() != nil && req.GetOwner().GetId() != nil {
 		root.SetOwner(req.GetOwner().GetId())
 	} else {
-		root.SetOwner(&userv1beta1.UserId{OpaqueId: spaceID, Type: userv1beta1.UserType_USER_TYPE_SPACE_OWNER})
+		root.SetOwner(&userv1beta1.UserId{
+			OpaqueId: spaceID,
+			TenantId: u.GetId().GetTenantId(),
+			Type:     userv1beta1.UserType_USER_TYPE_SPACE_OWNER,
+		})
 	}
 
 	metadata := node.Attributes{}
@@ -157,6 +161,9 @@ func (fs *Decomposedfs) CreateStorageSpace(ctx context.Context, req *provider.Cr
 	metadata.SetString(prefixes.OwnerIDPAttr, root.Owner().GetIdp())
 	metadata.SetString(prefixes.OwnerTypeAttr, utils.UserTypeToString(root.Owner().GetType()))
 
+	if root.Owner().GetTenantId() != "" {
+		metadata.SetString(prefixes.SpaceTenantIDAttr, root.Owner().GetTenantId())
+	}
 	// always mark the space root node as the end of propagation
 	metadata.SetString(prefixes.PropagationAttr, "1")
 	metadata.SetString(prefixes.NameAttr, req.Name)

vendor/github.com/opencloud-eu/reva/v2/pkg/user/manager/ldap/ldap.go

@@ -33,7 +33,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/user/manager/registry"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 )
 
@@ -61,8 +60,7 @@ func parseConfig(m map[string]interface{}) (*config, error) {
 		LDAPIdentity: ldapIdentity.New(),
 	}
 	if err := mapstructure.Decode(m, &c); err != nil {
-		err = errors.Wrap(err, "error decoding conf")
-		return nil, err
+		return nil, fmt.Errorf("error decoding conf: %w", err)
 	}
 
 	return &c, nil

vendor/github.com/opencloud-eu/reva/v2/pkg/utils/ldap/identity.go

@@ -20,6 +20,7 @@ package ldap
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -29,7 +30,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/appctx"
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
 	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
-	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
@@ -385,6 +385,13 @@ func (i *Identity) GetLDAPUserGroups(ctx context.Context, lc ldap.Client, userEn
 	sr, err := lc.Search(searchRequest)
 	if err != nil {
 		log.Debug().Str("backend", "ldap").Err(err).Str("filter", filter).Msg("Error looking up group memberships")
+		var lerr *ldap.Error
+		if errors.As(err, &lerr) && lerr.ResultCode == ldap.LDAPResultNoSuchObject {
+			// Don't error out if the search base doesn't exist. We are probably just
+			// not having any groups in LDAP
+			return []string{}, nil
+		}
+
 		span.SetAttributes(attribute.String("ldap.error", err.Error()))
 		span.SetStatus(codes.Error, "")
 		return []string{}, err
@@ -547,8 +554,7 @@ func (i *Identity) getUserFilter(uid *identityUser.UserId) (string, error) {
 	if i.User.Schema.IDIsOctetString {
 		id, err := uuid.Parse(uid.GetOpaqueId())
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", uid))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", uid, err)
 		}
 		escapedUUID = filterEscapeBinaryUUID(id)
 	} else {
@@ -583,8 +589,7 @@ func (i *Identity) getUserAttributeFilter(attribute, value, tenantID string) (st
 	if attribute == i.User.Schema.ID && i.User.Schema.IDIsOctetString {
 		id, err := uuid.Parse(value)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", value))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", value, err)
 		}
 		value = filterEscapeBinaryUUID(id)
 	} else {
@@ -718,8 +723,7 @@ func (i *Identity) getGroupFilter(id string) (string, error) {
 	if i.Group.Schema.IDIsOctetString {
 		id, err := uuid.Parse(id)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", id))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", id, err)
 		}
 		escapedUUID = filterEscapeBinaryUUID(id)
 	} else {
@@ -752,8 +756,7 @@ func (i *Identity) getGroupAttributeFilter(attribute, value string) (string, err
 	if attribute == i.Group.Schema.ID && i.Group.Schema.IDIsOctetString {
 		id, err := uuid.Parse(value)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", value))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", value, err)
 		}
 		value = filterEscapeBinaryUUID(id)
 	} else {