bump reva to lastest main

for https://github.com/opencloud-eu/reva/pull/372

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/storageprovider/storageprovider.go

@@ -1115,6 +1115,13 @@ func (s *Service) AddGrant(ctx context.Context, req *provider.AddGrantRequest) (
 		ctx = WithSpaceType(ctx, utils.ReadPlainFromOpaque(req.Opaque, "spacetype"))
 	}
 
+	// error out if no permissions are set
+	if req.GetGrant().GetPermissions() == nil {
+		return &provider.AddGrantResponse{
+			Status: status.NewInvalid(ctx, "permissions are invalid"),
+		}, nil
+	}
+
 	// check grantee type is valid
 	if req.Grant.Grantee.Type == provider.GranteeType_GRANTEE_TYPE_INVALID {
 		return &provider.AddGrantResponse{
@@ -1122,6 +1129,13 @@ func (s *Service) AddGrant(ctx context.Context, req *provider.AddGrantRequest) (
 		}, nil
 	}
 
+	// check if grantee has an id
+	if req.GetGrant().GetGrantee().GetId() == nil {
+		return &provider.AddGrantResponse{
+			Status: status.NewInvalid(ctx, "grantee id is invalid"),
+		}, nil
+	}
+
 	err := s.Storage.AddGrant(ctx, req.Ref, req.Grant)
 
 	return &provider.AddGrantResponse{

vendor/github.com/opencloud-eu/reva/v2/pkg/group/manager/ldap/ldap.go

@@ -35,7 +35,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 )
 
@@ -63,8 +62,7 @@ func parseConfig(m map[string]interface{}) (*config, error) {
 		LDAPIdentity: ldapIdentity.New(),
 	}
 	if err := mapstructure.Decode(m, &c); err != nil {
-		err = errors.Wrap(err, "error decoding conf")
-		return nil, err
+		return nil, fmt.Errorf("error decoding conf: %w", err)
 	}
 
 	return &c, nil

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/grants.go

@@ -28,6 +28,7 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/appctx"
 	ctxpkg "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/node"
@@ -118,6 +119,20 @@ func (fs *Decomposedfs) AddGrant(ctx context.Context, ref *provider.Reference, g
 		}
 	}
 
+	if sharedconf.MultiTenantEnabled() {
+		spaceTenant, err := grantNode.SpaceRoot.XattrString(ctx, prefixes.SpaceTenantIDAttr)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to read tenant id of space")
+			return errtypes.InternalError("error validating tenantID")
+		}
+		if g.Grantee.Type == provider.GranteeType_GRANTEE_TYPE_USER {
+			if g.Grantee.GetUserId().GetTenantId() != spaceTenant {
+				log.Error().Str("spaceTenant", spaceTenant).Str("granteeTenant", g.Grantee.GetUserId().GetTenantId()).Msg("cannot add grant for user from different tenant")
+				return errtypes.PermissionDenied("cannot add grant for user from different tenant")
+			}
+		}
+	}
+
 	return fs.storeGrant(ctx, grantNode, g)
 }
 

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes/prefixes.go

@@ -97,6 +97,7 @@ const (
 	SpaceReadmeAttr      string = OcPrefix + "space.readme"
 	SpaceImageAttr       string = OcPrefix + "space.image"
 	SpaceAliasAttr       string = OcPrefix + "space.alias"
+	SpaceTenantIDAttr    string = OcPrefix + "space.tenantid"
 
 	UserAcePrefix  string = "u:"
 	GroupAcePrefix string = "g:"

vendor/github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/spaces.go

@@ -147,7 +147,11 @@ func (fs *Decomposedfs) CreateStorageSpace(ctx context.Context, req *provider.Cr
 	if req.GetOwner() != nil && req.GetOwner().GetId() != nil {
 		root.SetOwner(req.GetOwner().GetId())
 	} else {
-		root.SetOwner(&userv1beta1.UserId{OpaqueId: spaceID, Type: userv1beta1.UserType_USER_TYPE_SPACE_OWNER})
+		root.SetOwner(&userv1beta1.UserId{
+			OpaqueId: spaceID,
+			TenantId: u.GetId().GetTenantId(),
+			Type:     userv1beta1.UserType_USER_TYPE_SPACE_OWNER,
+		})
 	}
 
 	metadata := node.Attributes{}
@@ -157,6 +161,9 @@ func (fs *Decomposedfs) CreateStorageSpace(ctx context.Context, req *provider.Cr
 	metadata.SetString(prefixes.OwnerIDPAttr, root.Owner().GetIdp())
 	metadata.SetString(prefixes.OwnerTypeAttr, utils.UserTypeToString(root.Owner().GetType()))
 
+	if root.Owner().GetTenantId() != "" {
+		metadata.SetString(prefixes.SpaceTenantIDAttr, root.Owner().GetTenantId())
+	}
 	// always mark the space root node as the end of propagation
 	metadata.SetString(prefixes.PropagationAttr, "1")
 	metadata.SetString(prefixes.NameAttr, req.Name)

vendor/github.com/opencloud-eu/reva/v2/pkg/user/manager/ldap/ldap.go

@@ -33,7 +33,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/user/manager/registry"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/attribute"
 )
 
@@ -61,8 +60,7 @@ func parseConfig(m map[string]interface{}) (*config, error) {
 		LDAPIdentity: ldapIdentity.New(),
 	}
 	if err := mapstructure.Decode(m, &c); err != nil {
-		err = errors.Wrap(err, "error decoding conf")
-		return nil, err
+		return nil, fmt.Errorf("error decoding conf: %w", err)
 	}
 
 	return &c, nil

vendor/github.com/opencloud-eu/reva/v2/pkg/utils/ldap/identity.go

@@ -20,6 +20,7 @@ package ldap
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -29,7 +30,6 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/appctx"
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
 	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
-	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
@@ -385,6 +385,13 @@ func (i *Identity) GetLDAPUserGroups(ctx context.Context, lc ldap.Client, userEn
 	sr, err := lc.Search(searchRequest)
 	if err != nil {
 		log.Debug().Str("backend", "ldap").Err(err).Str("filter", filter).Msg("Error looking up group memberships")
+		var lerr *ldap.Error
+		if errors.As(err, &lerr) && lerr.ResultCode == ldap.LDAPResultNoSuchObject {
+			// Don't error out if the search base doesn't exist. We are probably just
+			// not having any groups in LDAP
+			return []string{}, nil
+		}
+
 		span.SetAttributes(attribute.String("ldap.error", err.Error()))
 		span.SetStatus(codes.Error, "")
 		return []string{}, err
@@ -547,8 +554,7 @@ func (i *Identity) getUserFilter(uid *identityUser.UserId) (string, error) {
 	if i.User.Schema.IDIsOctetString {
 		id, err := uuid.Parse(uid.GetOpaqueId())
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", uid))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", uid, err)
 		}
 		escapedUUID = filterEscapeBinaryUUID(id)
 	} else {
@@ -583,8 +589,7 @@ func (i *Identity) getUserAttributeFilter(attribute, value, tenantID string) (st
 	if attribute == i.User.Schema.ID && i.User.Schema.IDIsOctetString {
 		id, err := uuid.Parse(value)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", value))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", value, err)
 		}
 		value = filterEscapeBinaryUUID(id)
 	} else {
@@ -718,8 +723,7 @@ func (i *Identity) getGroupFilter(id string) (string, error) {
 	if i.Group.Schema.IDIsOctetString {
 		id, err := uuid.Parse(id)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", id))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", id, err)
 		}
 		escapedUUID = filterEscapeBinaryUUID(id)
 	} else {
@@ -752,8 +756,7 @@ func (i *Identity) getGroupAttributeFilter(attribute, value string) (string, err
 	if attribute == i.Group.Schema.ID && i.Group.Schema.IDIsOctetString {
 		id, err := uuid.Parse(value)
 		if err != nil {
-			err := errors.Wrap(err, fmt.Sprintf("error parsing OpaqueID '%s' as UUID", value))
-			return "", err
+			return "", fmt.Errorf("error parsing OpaqueID '%s' as UUID: %w", value, err)
 		}
 		value = filterEscapeBinaryUUID(id)
 	} else {