Merge branch 'master' into config-doc-descriptions

services/ocs/pkg/command/health.go

@@ -0,0 +1,57 @@
+package command
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config/parser"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/logging"
+	"github.com/urfave/cli/v2"
+)
+
+// Health is the entrypoint for the health command.
+func Health(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "health",
+		Usage:    "check health status",
+		Category: "info",
+		Before: func(c *cli.Context) error {
+			err := parser.ParseConfig(cfg)
+			if err != nil {
+				fmt.Printf("%v", err)
+			}
+			return err
+		},
+		Action: func(c *cli.Context) error {
+			logger := logging.Configure(cfg.Service.Name, cfg.Log)
+
+			resp, err := http.Get(
+				fmt.Sprintf(
+					"http://%s/healthz",
+					cfg.Debug.Addr,
+				),
+			)
+
+			if err != nil {
+				logger.Fatal().
+					Err(err).
+					Msg("Failed to request health check")
+			}
+
+			defer resp.Body.Close()
+
+			if resp.StatusCode != http.StatusOK {
+				logger.Fatal().
+					Int("code", resp.StatusCode).
+					Msg("Health seems to be in bad state")
+			}
+
+			logger.Debug().
+				Int("code", resp.StatusCode).
+				Msg("Health got a good state")
+
+			return nil
+		},
+	}
+}

services/ocs/pkg/command/root.go

@@ -0,0 +1,64 @@
+package command
+
+import (
+	"context"
+	"os"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/clihelper"
+	ociscfg "github.com/owncloud/ocis/v2/ocis-pkg/config"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/thejerf/suture/v4"
+	"github.com/urfave/cli/v2"
+)
+
+// GetCommands provides all commands for this service
+func GetCommands(cfg *config.Config) cli.Commands {
+	return []*cli.Command{
+		// start this service
+		Server(cfg),
+
+		// interaction with this service
+
+		// infos about this service
+		Health(cfg),
+		Version(cfg),
+	}
+}
+
+// Execute is the entry point for the ocis-ocs command.
+func Execute(cfg *config.Config) error {
+	app := clihelper.DefaultApp(&cli.App{
+		Name:     "ocs",
+		Usage:    "Serve OCS API for oCIS",
+		Commands: GetCommands(cfg),
+	})
+
+	cli.HelpFlag = &cli.BoolFlag{
+		Name:  "help,h",
+		Usage: "Show the help",
+	}
+
+	return app.Run(os.Args)
+}
+
+// SutureService allows for the ocs command to be embedded and supervised by a suture supervisor tree.
+type SutureService struct {
+	cfg *config.Config
+}
+
+// NewSutureService creates a new ocs.SutureService
+func NewSutureService(cfg *ociscfg.Config) suture.Service {
+	cfg.OCS.Commons = cfg.Commons
+	return SutureService{
+		cfg: cfg.OCS,
+	}
+}
+
+func (s SutureService) Serve(ctx context.Context) error {
+	s.cfg.Context = ctx
+	if err := Execute(s.cfg); err != nil {
+		return err
+	}
+
+	return nil
+}

services/ocs/pkg/command/server.go

@@ -0,0 +1,106 @@
+package command
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/version"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config/parser"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/logging"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/tracing"
+
+	"github.com/oklog/run"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/metrics"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/server/debug"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/server/http"
+	"github.com/urfave/cli/v2"
+)
+
+// Server is the entrypoint for the server command.
+func Server(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "server",
+		Usage:    fmt.Sprintf("start %s extension without runtime (unsupervised mode)", cfg.Service.Name),
+		Category: "server",
+		Before: func(c *cli.Context) error {
+			err := parser.ParseConfig(cfg)
+			if err != nil {
+				fmt.Printf("%v", err)
+				os.Exit(1)
+			}
+			return err
+		},
+		Action: func(c *cli.Context) error {
+			logger := logging.Configure(cfg.Service.Name, cfg.Log)
+			err := tracing.Configure(cfg)
+			if err != nil {
+				return err
+			}
+
+			var (
+				gr          = run.Group{}
+				ctx, cancel = func() (context.Context, context.CancelFunc) {
+					if cfg.Context == nil {
+						return context.WithCancel(context.Background())
+					}
+					return context.WithCancel(cfg.Context)
+				}()
+				metrics = metrics.New()
+			)
+
+			defer cancel()
+
+			metrics.BuildInfo.WithLabelValues(version.GetString()).Set(1)
+
+			{
+				server, err := http.Server(
+					http.Logger(logger),
+					http.Context(ctx),
+					http.Config(cfg),
+					http.Metrics(metrics),
+				)
+
+				if err != nil {
+					logger.Info().
+						Err(err).
+						Str("transport", "http").
+						Msg("Failed to initialize server")
+
+					return err
+				}
+
+				gr.Add(func() error {
+					return server.Run()
+				}, func(_ error) {
+					logger.Info().
+						Str("transport", "http").
+						Msg("Shutting down server")
+
+					cancel()
+				})
+			}
+
+			{
+				server, err := debug.Server(
+					debug.Logger(logger),
+					debug.Context(ctx),
+					debug.Config(cfg),
+				)
+
+				if err != nil {
+					logger.Info().Err(err).Str("transport", "debug").Msg("Failed to initialize server")
+					return err
+				}
+
+				gr.Add(server.ListenAndServe, func(_ error) {
+					_ = server.Shutdown(ctx)
+					cancel()
+				})
+			}
+
+			return gr.Run()
+		},
+	}
+}

services/ocs/pkg/command/version.go

@@ -0,0 +1,50 @@
+package command
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/registry"
+	"github.com/owncloud/ocis/v2/ocis-pkg/version"
+
+	tw "github.com/olekukonko/tablewriter"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/urfave/cli/v2"
+)
+
+// Version prints the service versions of all running instances.
+func Version(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "version",
+		Usage:    "print the version of this binary and the running extension instances",
+		Category: "info",
+		Action: func(c *cli.Context) error {
+			fmt.Println("Version: " + version.GetString())
+			fmt.Printf("Compiled: %s\n", version.Compiled())
+			fmt.Println("")
+
+			reg := registry.GetRegistry()
+			services, err := reg.GetService(cfg.HTTP.Namespace + "." + cfg.Service.Name)
+			if err != nil {
+				fmt.Println(fmt.Errorf("could not get %s services from the registry: %v", cfg.Service.Name, err))
+				return err
+			}
+
+			if len(services) == 0 {
+				fmt.Println("No running " + cfg.Service.Name + " service found.")
+				return nil
+			}
+
+			table := tw.NewWriter(os.Stdout)
+			table.SetHeader([]string{"Version", "Address", "Id"})
+			table.SetAutoFormatHeaders(false)
+			for _, s := range services {
+				for _, n := range s.Nodes {
+					table.Append([]string{s.Version, n.Address, n.Id})
+				}
+			}
+			table.Render()
+			return nil
+		},
+	}
+}

services/ocs/pkg/config/config.go

@@ -0,0 +1,37 @@
+package config
+
+import (
+	"context"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
+)
+
+// Config combines all available configuration parts.
+type Config struct {
+	Commons *shared.Commons `yaml:"-"` // don't use this directly as configuration for a service
+
+	Service Service `yaml:"-"`
+
+	Tracing *Tracing `yaml:"tracing"`
+	Log     *Log     `yaml:"log"`
+	Debug   Debug    `yaml:"debug"`
+
+	HTTP HTTP `yaml:"http"`
+
+	TokenManager *TokenManager `yaml:"token_manager"`
+	Reva         *Reva         `yaml:"reva"`
+
+	IdentityManagement IdentityManagement `yaml:"identity_management"`
+
+	AccountBackend    string `yaml:"account_backend" env:"OCS_ACCOUNT_BACKEND_TYPE"`
+	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;OCS_MACHINE_AUTH_API_KEY" desc: "Machine auth API key used for accessing the 'auth-machine' service to impersonate users."`
+
+	Context context.Context `yaml:"-"`
+}
+
+// IdentityManagement keeps track of the OIDC address. This is because Reva requisite of uniqueness for users
+// is based in the combination of IDP hostname + UserID. For more information see:
+// https://github.com/cs3org/reva/blob/4fd0229f13fae5bc9684556a82dbbd0eced65ef9/pkg/storage/utils/decomposedfs/node/node.go#L856-L865
+type IdentityManagement struct {
+	Address string `yaml:"address" env:"OCIS_URL;OCIS_OIDC_ISSUER;OCS_IDM_ADDRESS" desc:"URL of the OIDC issuer. It defaults to URL of the builtin IDP."`
+}

services/ocs/pkg/config/debug.go

@@ -0,0 +1,9 @@
+package config
+
+// Debug defines the available debug configuration.
+type Debug struct {
+	Addr   string `yaml:"addr" env:"OCS_DEBUG_ADDR" desc:"Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed."`
+	Token  string `yaml:"token" env:"OCS_DEBUG_TOKEN" desc:"Token to secure the metrics endpoint"`
+	Pprof  bool   `yaml:"pprof" env:"OCS_DEBUG_PPROF" desc:"Enables pprof, which can be used for profiling"`
+	Zpages bool   `yaml:"zpages" env:"OCS_DEBUG_ZPAGES" desc:"Enables zpages, which can be used for collecting and viewing in-memory traces."`
+}

services/ocs/pkg/config/defaults/defaultconfig.go

@@ -0,0 +1,98 @@
+package defaults
+
+import (
+	"strings"
+
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+)
+
+func FullDefaultConfig() *config.Config {
+	cfg := DefaultConfig()
+	EnsureDefaults(cfg)
+	Sanitize(cfg)
+	return cfg
+}
+
+func DefaultConfig() *config.Config {
+	return &config.Config{
+		Debug: config.Debug{
+			Addr:   "127.0.0.1:9114",
+			Token:  "",
+			Pprof:  false,
+			Zpages: false,
+		},
+		HTTP: config.HTTP{
+			Addr:      "127.0.0.1:9110",
+			Root:      "/ocs",
+			Namespace: "com.owncloud.web",
+			CORS: config.CORS{
+				AllowedOrigins:   []string{"*"},
+				AllowedMethods:   []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
+				AllowedHeaders:   []string{"Authorization", "Origin", "Content-Type", "Accept", "X-Requested-With"},
+				AllowCredentials: true,
+			},
+		},
+		Service: config.Service{
+			Name: "ocs",
+		},
+		AccountBackend: "cs3",
+		Reva: &config.Reva{
+			Address: "127.0.0.1:9142",
+		},
+		IdentityManagement: config.IdentityManagement{
+			Address: "https://localhost:9200",
+		},
+	}
+}
+
+func EnsureDefaults(cfg *config.Config) {
+	// provide with defaults for shared logging, since we need a valid destination address for BindEnv.
+	if cfg.Log == nil && cfg.Commons != nil && cfg.Commons.Log != nil {
+		cfg.Log = &config.Log{
+			Level:  cfg.Commons.Log.Level,
+			Pretty: cfg.Commons.Log.Pretty,
+			Color:  cfg.Commons.Log.Color,
+			File:   cfg.Commons.Log.File,
+		}
+	} else if cfg.Log == nil {
+		cfg.Log = &config.Log{}
+	}
+	// provide with defaults for shared tracing, since we need a valid destination address for BindEnv.
+	if cfg.Tracing == nil && cfg.Commons != nil && cfg.Commons.Tracing != nil {
+		cfg.Tracing = &config.Tracing{
+			Enabled:   cfg.Commons.Tracing.Enabled,
+			Type:      cfg.Commons.Tracing.Type,
+			Endpoint:  cfg.Commons.Tracing.Endpoint,
+			Collector: cfg.Commons.Tracing.Collector,
+		}
+	} else if cfg.Tracing == nil {
+		cfg.Tracing = &config.Tracing{}
+	}
+
+	if cfg.Reva == nil && cfg.Commons != nil && cfg.Commons.Reva != nil {
+		cfg.Reva = &config.Reva{
+			Address: cfg.Commons.Reva.Address,
+		}
+	} else if cfg.Reva == nil {
+		cfg.Reva = &config.Reva{}
+	}
+
+	if cfg.TokenManager == nil && cfg.Commons != nil && cfg.Commons.TokenManager != nil {
+		cfg.TokenManager = &config.TokenManager{
+			JWTSecret: cfg.Commons.TokenManager.JWTSecret,
+		}
+	} else if cfg.TokenManager == nil {
+		cfg.TokenManager = &config.TokenManager{}
+	}
+
+	if cfg.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
+		cfg.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
+	}
+}
+
+func Sanitize(cfg *config.Config) {
+	// sanitize config
+	if cfg.HTTP.Root != "/" {
+		cfg.HTTP.Root = strings.TrimSuffix(cfg.HTTP.Root, "/")
+	}
+}

services/ocs/pkg/config/http.go

@@ -0,0 +1,17 @@
+package config
+
+// HTTP defines the available http configuration.
+type HTTP struct {
+	Addr      string `yaml:"addr" env:"OCS_HTTP_ADDR" desc:"The bind address of the HTTP service."`
+	Root      string `yaml:"root" env:"OCS_HTTP_ROOT" desc:"The root path of the HTTP service."`
+	Namespace string `yaml:"-"`
+	CORS      CORS   `yaml:"cors"`
+}
+
+// CORS defines the available cors configuration.
+type CORS struct {
+	AllowedOrigins   []string `yaml:"allowed_origins"`
+	AllowedMethods   []string `yaml:"allowed_methods"`
+	AllowedHeaders   []string `yaml:"allowed_headers"`
+	AllowCredentials bool     `yaml:"allowed_credentials"`
+}

services/ocs/pkg/config/log.go

@@ -0,0 +1,9 @@
+package config
+
+// Log defines the available log configuration.
+type Log struct {
+	Level  string `mapstructure:"level" env:"OCIS_LOG_LEVEL;OCS_LOG_LEVEL" desc:"The log level. Valid values are: \"panic\", \"fatal\", \"error\", \"warn\", \"info\", \"debug\", \"trace\"."`
+	Pretty bool   `mapstructure:"pretty" env:"OCIS_LOG_PRETTY;OCS_LOG_PRETTY" desc:"Activates pretty log output."`
+	Color  bool   `mapstructure:"color" env:"OCIS_LOG_COLOR;OCS_LOG_COLOR" desc:"Activates colorized log output."`
+	File   string `mapstructure:"file" env:"OCIS_LOG_FILE;OCS_LOG_FILE" desc:"The path to the log file. Activates logging to this file if set."`
+}

services/ocs/pkg/config/parser/parse.go

@@ -0,0 +1,47 @@
+package parser
+
+import (
+	"errors"
+
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config/defaults"
+
+	ociscfg "github.com/owncloud/ocis/v2/ocis-pkg/config"
+	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/config/envdecode"
+)
+
+// ParseConfig loads configuration from known paths.
+func ParseConfig(cfg *config.Config) error {
+	_, err := ociscfg.BindSourcesToStructs(cfg.Service.Name, cfg)
+	if err != nil {
+		return err
+	}
+
+	defaults.EnsureDefaults(cfg)
+
+	// load all env variables relevant to the config in the current context.
+	if err := envdecode.Decode(cfg); err != nil {
+		// no environment variable set for this config is an expected "error"
+		if !errors.Is(err, envdecode.ErrNoTargetFieldsAreSet) {
+			return err
+		}
+	}
+
+	defaults.Sanitize(cfg)
+
+	return Validate(cfg)
+}
+
+func Validate(cfg *config.Config) error {
+	if cfg.TokenManager.JWTSecret == "" {
+		return shared.MissingJWTTokenError(cfg.Service.Name)
+	}
+
+	if cfg.MachineAuthAPIKey == "" {
+		return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
+	}
+
+	return nil
+}

services/ocs/pkg/config/reva.go

@@ -0,0 +1,11 @@
+package config
+
+// Reva defines all available REVA configuration.
+type Reva struct {
+	Address string `yaml:"address" env:"REVA_GATEWAY" desc:"The CS3 gateway endpoint."`
+}
+
+// TokenManager is the config for using the reva token manager
+type TokenManager struct {
+	JWTSecret string `yaml:"jwt_secret" env:"OCIS_JWT_SECRET;OCS_JWT_SECRET" desc:"The secret to mint and validate jwt tokens."`
+}

services/ocs/pkg/config/service.go

@@ -0,0 +1,6 @@
+package config
+
+// Service defines the available service configuration.
+type Service struct {
+	Name string `yaml:"-"`
+}

services/ocs/pkg/config/tracing.go

@@ -0,0 +1,9 @@
+package config
+
+// Tracing defines the available tracing configuration.
+type Tracing struct {
+	Enabled   bool   `yaml:"enabled" env:"OCIS_TRACING_ENABLED;OCS_TRACING_ENABLED" desc:"Activates tracing."`
+	Type      string `yaml:"type" env:"OCIS_TRACING_TYPE;OCS_TRACING_TYPE" desc:"The type of tracing. Defaults to \"\", which is the same as \"jaeger\". Allowed tracing types are \"jaeger\" and \"\" as of now."`
+	Endpoint  string `yaml:"endpoint" env:"OCIS_TRACING_ENDPOINT;OCS_TRACING_ENDPOINT" desc:"The endpoint of the tracing agent."`
+	Collector string `yaml:"collector" env:"OCIS_TRACING_COLLECTOR;OCS_TRACING_COLLECTOR" desc:"The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset."`
+}

services/ocs/pkg/logging/logging.go

@@ -0,0 +1,17 @@
+package logging
+
+import (
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+)
+
+// LoggerFromConfig initializes a service-specific logger instance.
+func Configure(name string, cfg *config.Log) log.Logger {
+	return log.NewLogger(
+		log.Name(name),
+		log.Level(cfg.Level),
+		log.Pretty(cfg.Pretty),
+		log.Color(cfg.Color),
+		log.File(cfg.File),
+	)
+}

services/ocs/pkg/metrics/metrics.go

@@ -0,0 +1,45 @@
+package metrics
+
+import "github.com/prometheus/client_golang/prometheus"
+
+var (
+	// Namespace defines the namespace for the defines metrics.
+	Namespace = "ocis"
+
+	// Subsystem defines the subsystem for the defines metrics.
+	Subsystem = "ocs"
+)
+
+// Metrics defines the available metrics of this service.
+type Metrics struct {
+	// Counter  *prometheus.CounterVec
+	BuildInfo *prometheus.GaugeVec
+}
+
+// New initializes the available metrics.
+func New() *Metrics {
+	m := &Metrics{
+		// Counter: prometheus.NewCounterVec(prometheus.CounterOpts{
+		// 	Namespace: Namespace,
+		// 	Subsystem: Subsystem,
+		// 	Name:      "greet_total",
+		// 	Help:      "How many greeting requests processed",
+		// }, []string{}),
+		BuildInfo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: Subsystem,
+			Name:      "build_info",
+			Help:      "Build Information",
+		}, []string{"version"}),
+	}
+
+	// prometheus.Register(
+	// 	m.Counter,
+	// )
+
+	_ = prometheus.Register(
+		m.BuildInfo,
+	)
+
+	return m
+}

services/ocs/pkg/middleware/format.go

@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-chi/render"
+)
+
+// OCSFormatCtx middleware is used to determine the content type from
+// the format URL parameter passed in an ocs request. Defaults to XML
+func OCSFormatCtx(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Query().Get("format") {
+		case "", "xml":
+			r.Header.Set("Accept", "application/xml")
+			r = r.WithContext(context.WithValue(r.Context(), render.ContentTypeCtxKey, render.ContentTypeXML))
+		case "json":
+			r.Header.Set("Accept", "application/json")
+			r = r.WithContext(context.WithValue(r.Context(), render.ContentTypeCtxKey, render.ContentTypeJSON))
+		}
+		next.ServeHTTP(w, r)
+	})
+}

services/ocs/pkg/middleware/logtrace.go

@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"net/http"
+
+	ocstracing "github.com/owncloud/ocis/v2/services/ocs/pkg/tracing"
+	"go.opentelemetry.io/otel/propagation"
+)
+
+var propagator = propagation.NewCompositeTextMapPropagator(
+	propagation.Baggage{},
+	propagation.TraceContext{},
+)
+
+// LogTrace Sets the initial trace in the ocs service.
+func LogTrace(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx, span := ocstracing.TraceProvider.Tracer("ocs").Start(r.Context(), r.URL.Path)
+		defer span.End()
+
+		propagator.Inject(ctx, propagation.HeaderCarrier(r.Header))
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}

services/ocs/pkg/middleware/options.go

@@ -0,0 +1,42 @@
+package middleware
+
+import (
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	// Logger to use for logging, must be set
+	Logger log.Logger
+	// RoleManager for looking up permissions
+	RoleManager *roles.Manager
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(l log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = l
+	}
+}
+
+// RoleManager provides a function to set the RoleManager option.
+func RoleManager(val *roles.Manager) Option {
+	return func(o *Options) {
+		o.RoleManager = val
+	}
+}

services/ocs/pkg/middleware/requireadmin.go

@@ -0,0 +1,42 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/go-chi/render"
+	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+	settings "github.com/owncloud/ocis/v2/services/settings/pkg/service/v0"
+)
+
+// RequireAdmin middleware is used to require the user in context to be an admin / have account management permissions
+func RequireAdmin(opts ...Option) func(next http.Handler) http.Handler {
+	opt := newOptions(opts...)
+
+	mustRender := func(w http.ResponseWriter, r *http.Request, renderer render.Renderer) {
+		if err := render.Render(w, r, renderer); err != nil {
+			opt.Logger.Err(err).Msgf("failed to write response for ocs request %s on %s", r.Method, r.URL)
+		}
+	}
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+			// get roles from context
+			roleIDs, ok := roles.ReadRoleIDsFromContext(r.Context())
+			if !ok {
+				mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+				return
+			}
+
+			// check if permission is present in roles of the authenticated account
+			if opt.RoleManager.FindPermissionByID(r.Context(), roleIDs, settings.AccountManagementPermissionID) != nil {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+		})
+	}
+}

services/ocs/pkg/middleware/requireselforadmin.go

@@ -0,0 +1,82 @@
+package middleware
+
+import (
+	"net/http"
+	"net/url"
+
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+	settings "github.com/owncloud/ocis/v2/services/settings/pkg/service/v0"
+	settingsService "github.com/owncloud/ocis/v2/services/settings/pkg/service/v0"
+)
+
+// RequireSelfOrAdmin middleware is used to require the requesting user to be an admin or the requested user himself
+func RequireSelfOrAdmin(opts ...Option) func(next http.Handler) http.Handler {
+	opt := newOptions(opts...)
+
+	mustRender := func(w http.ResponseWriter, r *http.Request, renderer render.Renderer) {
+		if err := render.Render(w, r, renderer); err != nil {
+			opt.Logger.Err(err).Msgf("failed to write response for ocs request %s on %s", r.Method, r.URL)
+		}
+	}
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+			u, ok := revactx.ContextGetUser(r.Context())
+			if !ok {
+				mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+				return
+			}
+			if u.Id == nil || u.Id.OpaqueId == "" {
+				mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "user is missing an id"))
+				return
+			}
+			// get roles from context
+			roleIDs, ok := roles.ReadRoleIDsFromContext(r.Context())
+			if !ok {
+				opt.Logger.Debug().Str("userid", u.Id.OpaqueId).Msg("No roles in context, contacting settings service")
+				var err error
+				roleIDs, err = opt.RoleManager.FindRoleIDsForUser(r.Context(), u.Id.OpaqueId)
+				if err != nil {
+					opt.Logger.Err(err).Str("userid", u.Id.OpaqueId).Msg("failed to get roles for user")
+					mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+					return
+				}
+				if len(roleIDs) == 0 {
+					roleIDs = append(roleIDs, settingsService.BundleUUIDRoleUser, settingsService.SelfManagementPermissionID)
+					// if roles are empty, assume we haven't seen the user before and assign a default user role. At least until
+					// proper roles are provided. See https://github.com/owncloud/ocis/v2/issues/1825 for more context.
+					//return user, nil
+				}
+			}
+
+			// check if account management permission is present in roles of the authenticated account
+			if opt.RoleManager.FindPermissionByID(r.Context(), roleIDs, settings.AccountManagementPermissionID) != nil {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// check if self management permission is present in roles of the authenticated account
+			if opt.RoleManager.FindPermissionByID(r.Context(), roleIDs, settings.SelfManagementPermissionID) != nil {
+				userid := chi.URLParam(r, "userid")
+				var err error
+				if userid, err = url.PathUnescape(userid); err != nil {
+					mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "malformed username"))
+				}
+
+				if userid == "" || userid == u.Id.OpaqueId || userid == u.Username {
+					next.ServeHTTP(w, r)
+					return
+				}
+			}
+
+			mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+
+		})
+	}
+}

services/ocs/pkg/middleware/requireuser.go

@@ -0,0 +1,39 @@
+package middleware
+
+import (
+	"net/http"
+
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/go-chi/render"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+)
+
+// RequireUser middleware is used to require a user in context
+func RequireUser(opts ...Option) func(next http.Handler) http.Handler {
+	opt := newOptions(opts...)
+
+	mustRender := func(w http.ResponseWriter, r *http.Request, renderer render.Renderer) {
+		if err := render.Render(w, r, renderer); err != nil {
+			opt.Logger.Err(err).Msgf("failed to write response for ocs request %s on %s", r.Method, r.URL)
+		}
+	}
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+			u, ok := revactx.ContextGetUser(r.Context())
+			if !ok {
+				mustRender(w, r, response.ErrRender(data.MetaUnauthorized.StatusCode, "Unauthorized"))
+				return
+			}
+			if u.Id == nil || u.Id.OpaqueId == "" {
+				mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "user is missing an id"))
+				return
+			}
+
+			next.ServeHTTP(w, r)
+
+		})
+	}
+}

services/ocs/pkg/server/debug/option.go

@@ -0,0 +1,50 @@
+package debug
+
+import (
+	"context"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger  log.Logger
+	Context context.Context
+	Config  *config.Config
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Context provides a function to set the context option.
+func Context(val context.Context) Option {
+	return func(o *Options) {
+		o.Context = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}

services/ocs/pkg/server/debug/server.go

@@ -0,0 +1,63 @@
+package debug
+
+import (
+	"io"
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/service/debug"
+	"github.com/owncloud/ocis/v2/ocis-pkg/version"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+)
+
+// Server initializes the debug service and server.
+func Server(opts ...Option) (*http.Server, error) {
+	options := newOptions(opts...)
+
+	return debug.NewService(
+		debug.Logger(options.Logger),
+		debug.Name(options.Config.Service.Name),
+		debug.Version(version.GetString()),
+		debug.Address(options.Config.Debug.Addr),
+		debug.Token(options.Config.Debug.Token),
+		debug.Pprof(options.Config.Debug.Pprof),
+		debug.Zpages(options.Config.Debug.Zpages),
+		debug.Health(health(options.Config)),
+		debug.Ready(ready(options.Config)),
+		debug.CorsAllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins),
+		debug.CorsAllowedMethods(options.Config.HTTP.CORS.AllowedMethods),
+		debug.CorsAllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
+		debug.CorsAllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
+	), nil
+}
+
+// health implements the health check.
+func health(cfg *config.Config) func(http.ResponseWriter, *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.WriteHeader(http.StatusOK)
+
+		// TODO: check if services are up and running
+
+		_, err := io.WriteString(w, http.StatusText(http.StatusOK))
+		// io.WriteString should not fail but if it does we want to know.
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
+// ready implements the ready check.
+func ready(cfg *config.Config) func(http.ResponseWriter, *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.WriteHeader(http.StatusOK)
+
+		// TODO: check if services are up and running
+
+		_, err := io.WriteString(w, http.StatusText(http.StatusOK))
+		// io.WriteString should not fail but if it does we want to know.
+		if err != nil {
+			panic(err)
+		}
+	}
+}

services/ocs/pkg/server/http/option.go

@@ -0,0 +1,76 @@
+package http
+
+import (
+	"context"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/metrics"
+	"github.com/urfave/cli/v2"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Namespace string
+	Logger    log.Logger
+	Context   context.Context
+	Config    *config.Config
+	Metrics   *metrics.Metrics
+	Flags     []cli.Flag
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Context provides a function to set the context option.
+func Context(val context.Context) Option {
+	return func(o *Options) {
+		o.Context = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}
+
+// Metrics provides a function to set the metrics option.
+func Metrics(val *metrics.Metrics) Option {
+	return func(o *Options) {
+		o.Metrics = val
+	}
+}
+
+// Flags provides a function to set the flags option.
+func Flags(val []cli.Flag) Option {
+	return func(o *Options) {
+		o.Flags = append(o.Flags, val...)
+	}
+}
+
+// Namespace provides a function to set the Namespace option.
+func Namespace(val string) Option {
+	return func(o *Options) {
+		o.Namespace = val
+	}
+}

services/ocs/pkg/server/http/server.go

@@ -0,0 +1,63 @@
+package http
+
+import (
+	chimiddleware "github.com/go-chi/chi/v5/middleware"
+	"github.com/owncloud/ocis/v2/ocis-pkg/cors"
+	"github.com/owncloud/ocis/v2/ocis-pkg/middleware"
+	"github.com/owncloud/ocis/v2/ocis-pkg/service/http"
+	"github.com/owncloud/ocis/v2/ocis-pkg/version"
+	ocsmw "github.com/owncloud/ocis/v2/services/ocs/pkg/middleware"
+	svc "github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0"
+	"go-micro.dev/v4"
+)
+
+// Server initializes the http service and server.
+func Server(opts ...Option) (http.Service, error) {
+	options := newOptions(opts...)
+
+	service := http.NewService(
+		http.Logger(options.Logger),
+		http.Name(options.Config.Service.Name),
+		http.Version(version.GetString()),
+		http.Namespace(options.Config.HTTP.Namespace),
+		http.Address(options.Config.HTTP.Addr),
+		http.Context(options.Context),
+		http.Flags(options.Flags...),
+	)
+
+	handle := svc.NewService(
+		svc.Logger(options.Logger),
+		svc.Config(options.Config),
+		svc.Middleware(
+			chimiddleware.RealIP,
+			chimiddleware.RequestID,
+			middleware.NoCache,
+			middleware.Cors(
+				cors.Logger(options.Logger),
+				cors.AllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins),
+				cors.AllowedMethods(options.Config.HTTP.CORS.AllowedMethods),
+				cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
+				cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
+			),
+			middleware.Secure,
+			middleware.Version(
+				options.Config.Service.Name,
+				version.GetString(),
+			),
+			middleware.Logger(options.Logger),
+			ocsmw.LogTrace,
+		),
+	)
+
+	{
+		handle = svc.NewInstrument(handle, options.Metrics)
+		handle = svc.NewLogging(handle, options.Logger)
+		handle = svc.NewTracing(handle)
+	}
+
+	if err := micro.RegisterHandler(service.Server(), handle); err != nil {
+		return http.Service{}, err
+	}
+
+	return service, nil
+}

services/ocs/pkg/service/v0/config.go

@@ -0,0 +1,19 @@
+package svc
+
+import (
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+)
+
+// GetConfig renders the ocs config endpoint
+func (o Ocs) GetConfig(w http.ResponseWriter, r *http.Request) {
+	o.mustRender(w, r, response.DataRender(&data.ConfigData{
+		Version: "1.7",  // TODO get from env
+		Website: "ocis", // TODO get from env
+		Host:    "",     // TODO get from FRONTEND config
+		Contact: "",     // TODO get from env
+		SSL:     "true", // TODO get from env
+	}))
+}

services/ocs/pkg/service/v0/data/config.go

@@ -0,0 +1,10 @@
+package data
+
+// ConfigData holds basic config
+type ConfigData struct {
+	Version string `json:"version" xml:"version"`
+	Website string `json:"website" xml:"website"`
+	Host    string `json:"host" xml:"host"`
+	Contact string `json:"contact" xml:"contact"`
+	SSL     string `json:"ssl" xml:"ssl"`
+}

services/ocs/pkg/service/v0/data/group.go

@@ -0,0 +1,6 @@
+package data
+
+// Groups holds group ids for the groups listing
+type Groups struct {
+	Groups []string `json:"groups" xml:"groups>element"`
+}

services/ocs/pkg/service/v0/data/meta.go

@@ -0,0 +1,43 @@
+package data
+
+// Meta holds response metadata
+type Meta struct {
+	Status       string `json:"status" xml:"status"`
+	StatusCode   int    `json:"statuscode" xml:"statuscode"`
+	Message      string `json:"message" xml:"message"`
+	TotalItems   string `json:"totalitems,omitempty" xml:"totalitems,omitempty"`
+	ItemsPerPage string `json:"itemsperpage,omitempty" xml:"itemsperpage,omitempty"`
+}
+
+// MetaOK is the default ok response with code 100
+var MetaOK = Meta{Status: "ok", StatusCode: 100, Message: "OK"}
+
+// MetaFailure is a failure response with code 101
+var MetaFailure = Meta{Status: "", StatusCode: 101, Message: "Failure"}
+
+// MetaInvalidInput is an error response with code 102
+var MetaInvalidInput = Meta{Status: "", StatusCode: 102, Message: "Invalid Input"}
+
+// MetaForbidden is an error response with code 104
+var MetaForbidden = Meta{Status: "", StatusCode: 104, Message: "Forbidden"}
+
+// MetaBadRequest is used for unknown errors
+var MetaBadRequest = Meta{Status: "error", StatusCode: 400, Message: "Bad Request"}
+
+// MetaServerError is returned on server errors
+var MetaServerError = Meta{Status: "error", StatusCode: 996, Message: "Server Error"}
+
+// MetaUnauthorized is returned on unauthorized requests
+var MetaUnauthorized = Meta{Status: "error", StatusCode: 997, Message: "Unauthorised"}
+
+// MetaNotFound is returned when trying to access not existing resources
+var MetaNotFound = Meta{Status: "error", StatusCode: 998, Message: "Not Found"}
+
+// MetaUnknownError is used for unknown errors
+var MetaUnknownError = Meta{Status: "error", StatusCode: 999, Message: "Unknown Error"}
+
+// MessageUserNotFound is  used when a user can not be found
+var MessageUserNotFound = "The requested user could not be found"
+
+// MessageGroupNotFound is used when a group can not be found
+var MessageGroupNotFound = "The requested group could not be found"

services/ocs/pkg/service/v0/data/user.go

@@ -0,0 +1,33 @@
+package data
+
+// Users holds user ids for the user listing
+type Users struct {
+	Users []string `json:"users" xml:"users>element"`
+}
+
+// User holds the payload for a GetUser response
+type User struct {
+	Enabled           string `json:"enabled" xml:"enabled"`
+	UserID            string `json:"id" xml:"id"` // UserID is mapped to the preferred_name attribute in accounts
+	DisplayName       string `json:"display-name" xml:"display-name"`
+	LegacyDisplayName string `json:"displayname" xml:"displayname"`
+	Email             string `json:"email" xml:"email"`
+	Quota             *Quota `json:"quota" xml:"quota"`
+	UIDNumber         int64  `json:"uidnumber" xml:"uidnumber"`
+	GIDNumber         int64  `json:"gidnumber" xml:"gidnumber"`
+}
+
+// Quota holds quota information
+type Quota struct {
+	Free       int64   `json:"free" xml:"free"`
+	Used       int64   `json:"used" xml:"used"`
+	Total      int64   `json:"total" xml:"total"`
+	Relative   float32 `json:"relative" xml:"relative"`
+	Definition string  `json:"definition" xml:"definition"`
+}
+
+// SigningKey holds the Payload for a GetSigningKey response
+type SigningKey struct {
+	User       string `json:"user" xml:"user"`
+	SigningKey string `json:"signing-key" xml:"signing-key"`
+}

services/ocs/pkg/service/v0/groups.go

@@ -0,0 +1,98 @@
+package svc
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+)
+
+// ListUserGroups lists a users groups
+func (o Ocs) ListUserGroups(w http.ResponseWriter, r *http.Request) {
+	userid := chi.URLParam(r, "userid")
+	userid, _ = url.PathUnescape(userid)
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.mustRender(w, r, response.DataRender(&data.Groups{}))
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+	return
+}
+
+// AddToGroup adds a user to a group
+func (o Ocs) AddToGroup(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// RemoveFromGroup removes a user from a group
+func (o Ocs) RemoveFromGroup(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// ListGroups lists all groups
+func (o Ocs) ListGroups(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.mustRender(w, r, response.DataRender(&data.Groups{}))
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+	return
+}
+
+// AddGroup adds a group
+// oC10 implementation: https://github.com/owncloud/core/blob/762780a23c9eadda4fb5fa8db99eba66a5100b6e/apps/provisioning_api/lib/Groups.php#L126-L154
+func (o Ocs) AddGroup(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// DeleteGroup deletes a group
+func (o Ocs) DeleteGroup(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// GetGroupMembers lists all members of a group
+func (o Ocs) GetGroupMembers(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.mustRender(w, r, response.DataRender(&data.Users{}))
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+	return
+}

services/ocs/pkg/service/v0/instrument.go

@@ -0,0 +1,30 @@
+package svc
+
+import (
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/metrics"
+)
+
+// NewInstrument returns a service that instruments metrics.
+func NewInstrument(next Service, metrics *metrics.Metrics) Service {
+	return instrument{
+		next:    next,
+		metrics: metrics,
+	}
+}
+
+type instrument struct {
+	next    Service
+	metrics *metrics.Metrics
+}
+
+// ServeHTTP implements the Service interface.
+func (i instrument) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	i.next.ServeHTTP(w, r)
+}
+
+// GetConfig implements the Service interface.
+func (i instrument) GetConfig(w http.ResponseWriter, r *http.Request) {
+	i.next.GetConfig(w, r)
+}

services/ocs/pkg/service/v0/logging.go

@@ -0,0 +1,30 @@
+package svc
+
+import (
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+)
+
+// NewLogging returns a service that logs messages.
+func NewLogging(next Service, logger log.Logger) Service {
+	return logging{
+		next:   next,
+		logger: logger,
+	}
+}
+
+type logging struct {
+	next   Service
+	logger log.Logger
+}
+
+// ServeHTTP implements the Service interface.
+func (l logging) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	l.next.ServeHTTP(w, r)
+}
+
+// GetConfig implements the Service interface.
+func (l logging) GetConfig(w http.ResponseWriter, r *http.Request) {
+	l.next.GetConfig(w, r)
+}

services/ocs/pkg/service/v0/option.go

@@ -0,0 +1,68 @@
+package svc
+
+import (
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
+	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger      log.Logger
+	Config      *config.Config
+	Middleware  []func(http.Handler) http.Handler
+	RoleService settingssvc.RoleService
+	RoleManager *roles.Manager
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// Config provides a function to set the config option.
+func Config(val *config.Config) Option {
+	return func(o *Options) {
+		o.Config = val
+	}
+}
+
+// Middleware provides a function to set the middleware option.
+func Middleware(val ...func(http.Handler) http.Handler) Option {
+	return func(o *Options) {
+		o.Middleware = val
+	}
+}
+
+// RoleService provides a function to set the RoleService option.
+func RoleService(val settingssvc.RoleService) Option {
+	return func(o *Options) {
+		o.RoleService = val
+	}
+}
+
+// RoleManager provides a function to set the RoleManager option.
+func RoleManager(val *roles.Manager) Option {
+	return func(o *Options) {
+		o.RoleManager = val
+	}
+}

services/ocs/pkg/service/v0/response/response.go

@@ -0,0 +1,114 @@
+package response
+
+import (
+	"encoding/xml"
+	"net/http"
+	"reflect"
+
+	"github.com/go-chi/render"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+)
+
+// Response is the top level response structure
+type Response struct {
+	OCS *Payload `json:"ocs" xml:"ocs"`
+}
+
+var (
+	elementStartElement = xml.StartElement{Name: xml.Name{Local: "element"}}
+	metaStartElement    = xml.StartElement{Name: xml.Name{Local: "meta"}}
+	ocsName             = xml.Name{Local: "ocs"}
+	dataName            = xml.Name{Local: "data"}
+)
+
+// Payload combines response metadata and data
+type Payload struct {
+	Meta data.Meta   `json:"meta" xml:"meta"`
+	Data interface{} `json:"data,omitempty" xml:"data,omitempty"`
+}
+
+// MarshalXML handles ocs specific wrapping of array members in 'element' tags for the data
+func (rsp Response) MarshalXML(e *xml.Encoder, start xml.StartElement) (err error) {
+	// first the easy part
+	// use ocs as the surrounding tag
+	start.Name = ocsName
+	if err = e.EncodeToken(start); err != nil {
+		return
+	}
+
+	// encode the meta tag
+	if err = e.EncodeElement(rsp.OCS.Meta, metaStartElement); err != nil {
+		return
+	}
+
+	// we need to use reflection to determine if p.Data is an array or a slice
+	rt := reflect.TypeOf(rsp.OCS.Data)
+	if rt != nil && (rt.Kind() == reflect.Array || rt.Kind() == reflect.Slice) {
+		// this is how to wrap the data elements in their own <element> tag
+		v := reflect.ValueOf(rsp.OCS.Data)
+		if err = e.EncodeToken(xml.StartElement{Name: dataName}); err != nil {
+			return
+		}
+		for i := 0; i < v.Len(); i++ {
+			if err = e.EncodeElement(v.Index(i).Interface(), elementStartElement); err != nil {
+				return
+			}
+		}
+		if err = e.EncodeToken(xml.EndElement{Name: dataName}); err != nil {
+			return
+		}
+	} else if err = e.EncodeElement(rsp.OCS.Data, xml.StartElement{Name: dataName}); err != nil {
+		return
+	}
+
+	// write the closing <ocs> tag
+	if err = e.EncodeToken(xml.EndElement{Name: start.Name}); err != nil {
+		return
+	}
+	return
+}
+
+// Render sets the status code of the http response, taking the ocs version into account
+func (rsp *Response) Render(w http.ResponseWriter, r *http.Request) error {
+	version := APIVersion(r.Context())
+	m := statusCodeMapper(version)
+	statusCode := m(rsp.OCS.Meta)
+	render.Status(r, statusCode)
+	if version == ocsVersion2 && statusCode == http.StatusOK {
+		rsp.OCS.Meta.StatusCode = statusCode
+	}
+	return nil
+}
+
+// DataRender creates an OK Payload for the given data
+func DataRender(d interface{}) render.Renderer {
+	return &Response{
+		&Payload{
+			Meta: data.MetaOK,
+			Data: d,
+		},
+	}
+}
+
+// ErrRender creates an Error Payload with the given OCS error code and message
+// The httpcode will be determined using the API version stored in the context
+func ErrRender(c int, m string) render.Renderer {
+	return &Response{
+		&Payload{
+			Meta: data.Meta{Status: "error", StatusCode: c, Message: m},
+		},
+	}
+}
+
+func statusCodeMapper(version string) func(data.Meta) int {
+	var mapper func(data.Meta) int
+	switch version {
+	case ocsVersion1:
+		mapper = OcsV1StatusCodes
+	case ocsVersion2:
+		mapper = OcsV2StatusCodes
+	default:
+		mapper = defaultStatusCodeMapper
+	}
+	return mapper
+}

services/ocs/pkg/service/v0/response/version.go

@@ -0,0 +1,92 @@
+package response
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+)
+
+type key int
+
+const (
+	apiVersionKey key = iota
+	ocsVersion1       = "1"
+	ocsVersion2       = "2"
+)
+
+var (
+	defaultStatusCodeMapper = OcsV2StatusCodes
+)
+
+// APIVersion retrieves the api version from the context.
+func APIVersion(ctx context.Context) string {
+	value := ctx.Value(apiVersionKey)
+	if value != nil {
+		return value.(string)
+	}
+	return ""
+}
+
+// OcsV1StatusCodes returns the http status codes for the OCS API v1.
+func OcsV1StatusCodes(meta data.Meta) int {
+	if meta.StatusCode == data.MetaUnauthorized.StatusCode {
+		return http.StatusUnauthorized
+	}
+	return http.StatusOK
+}
+
+// OcsV2StatusCodes maps the OCS codes to http status codes for the ocs API v2.
+// see https://github.com/owncloud/core/blob/c08baf580927ecb8ec179028dda255fdd85b4568/lib/private/legacy/api.php#L528
+// also HTTP status codes for apps are the same as OCS codes
+// see https://github.com/owncloud/core/blob/b9ff4c93e051c94adfb301545098ae627e52ef76/lib/public/AppFramework/OCSController.php#L142-L150
+// I think this is a bug in the ocs v2 api, but since we are going to mimic bugs in ocis ... here goes
+func OcsV2StatusCodes(meta data.Meta) int {
+	sc := meta.StatusCode
+	switch sc {
+	case data.MetaNotFound.StatusCode:
+		return http.StatusNotFound
+	case data.MetaUnknownError.StatusCode:
+		fallthrough
+	case data.MetaServerError.StatusCode:
+		return http.StatusInternalServerError
+	case data.MetaUnauthorized.StatusCode:
+		return http.StatusUnauthorized
+	case data.MetaOK.StatusCode:
+		// TODO mustn't data.Meta be a pointer so this assignment has an effect
+		meta.StatusCode = http.StatusOK
+		return http.StatusOK
+	}
+	// any 2xx, 4xx and 5xx will be used as is
+	if sc >= 200 && sc < 600 {
+		return sc
+	}
+
+	// any error codes > 100 are treated as client errors
+	if sc > 100 && sc < 200 {
+		return http.StatusBadRequest
+	}
+
+	// TODO change this status code? yes, align with oc10 core mapStatusCodes
+	return http.StatusOK
+}
+
+// VersionCtx middleware is used to determine the response mapper from
+// the URL parameters passed through as the request. In case
+// the Version is unknown, we stop here and return a 404.
+func VersionCtx(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		version := chi.URLParam(r, "version")
+		if version == "" {
+			_ = render.Render(w, r, ErrRender(data.MetaBadRequest.StatusCode, "unknown ocs api version"))
+			return
+		}
+		w.Header().Set("Ocs-Api-Version", version)
+
+		// store version in context so handlers can access it
+		ctx := context.WithValue(r.Context(), apiVersionKey, version)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}

services/ocs/pkg/service/v0/service.go

@@ -0,0 +1,133 @@
+package svc
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/cs3org/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/owncloud/ocis/v2/ocis-pkg/service/grpc"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/render"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/account"
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	opkgm "github.com/owncloud/ocis/v2/ocis-pkg/middleware"
+	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
+	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	ocsm "github.com/owncloud/ocis/v2/services/ocs/pkg/middleware"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+	"github.com/owncloud/ocis/v2/services/proxy/pkg/user/backend"
+)
+
+// Service defines the extension handlers.
+type Service interface {
+	ServeHTTP(http.ResponseWriter, *http.Request)
+	GetConfig(http.ResponseWriter, *http.Request)
+}
+
+// NewService returns a service implementation for Service.
+func NewService(opts ...Option) Service {
+	options := newOptions(opts...)
+
+	m := chi.NewMux()
+	m.Use(options.Middleware...)
+
+	roleService := options.RoleService
+	if roleService == nil {
+		roleService = settingssvc.NewRoleService("com.owncloud.api.settings", grpc.DefaultClient)
+	}
+	roleManager := options.RoleManager
+	if roleManager == nil {
+		m := roles.NewManager(
+			roles.CacheSize(1024),
+			roles.CacheTTL(time.Hour*24*7),
+			roles.Logger(options.Logger),
+			roles.RoleService(roleService),
+		)
+		roleManager = &m
+	}
+
+	svc := Ocs{
+		config:      options.Config,
+		mux:         m,
+		RoleManager: roleManager,
+		logger:      options.Logger,
+	}
+
+	if svc.config.AccountBackend == "" {
+		svc.config.AccountBackend = "cs3"
+	}
+
+	requireUser := ocsm.RequireUser(
+		ocsm.Logger(options.Logger),
+	)
+
+	m.Route(options.Config.HTTP.Root, func(r chi.Router) {
+		r.NotFound(svc.NotFound)
+		r.Use(middleware.StripSlashes)
+		r.Use(opkgm.ExtractAccountUUID(
+			account.Logger(options.Logger),
+			account.JWTSecret(options.Config.TokenManager.JWTSecret)),
+		)
+		r.Use(ocsm.OCSFormatCtx) // updates request Accept header according to format=(json|xml) query parameter
+		r.Route("/v{version:(1|2)}.php", func(r chi.Router) {
+			r.Use(response.VersionCtx) // stores version in context
+			r.Route("/apps/files_sharing/api/v1", func(r chi.Router) {})
+			r.Route("/apps/notifications/api/v1", func(r chi.Router) {})
+			r.Route("/cloud", func(r chi.Router) {
+				r.Route("/capabilities", func(r chi.Router) {})
+				// TODO /apps
+				r.Route("/user", func(r chi.Router) {
+					r.Get("/signing-key", svc.GetSigningKey)
+				})
+			})
+			r.Route("/config", func(r chi.Router) {
+				r.With(requireUser).Get("/", svc.GetConfig)
+			})
+		})
+	})
+
+	return svc
+}
+
+// Ocs defines implements the business logic for Service.
+type Ocs struct {
+	config      *config.Config
+	logger      log.Logger
+	RoleService settingssvc.RoleService
+	RoleManager *roles.Manager
+	mux         *chi.Mux
+}
+
+// ServeHTTP implements the Service interface.
+func (o Ocs) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	o.mux.ServeHTTP(w, r)
+}
+
+// NotFound uses ErrRender to always return a proper OCS payload
+func (o Ocs) NotFound(w http.ResponseWriter, r *http.Request) {
+	o.mustRender(w, r, response.ErrRender(data.MetaNotFound.StatusCode, "not found"))
+}
+
+func (o Ocs) getCS3Backend() backend.UserBackend {
+	revaClient, err := pool.GetGatewayServiceClient(o.config.Reva.Address)
+	if err != nil {
+		o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.Reva.Address)
+	}
+	return backend.NewCS3UserBackend(nil, revaClient, o.config.MachineAuthAPIKey, "", nil, o.logger)
+}
+
+// NotImplementedStub returns a not implemented error
+func (o Ocs) NotImplementedStub(w http.ResponseWriter, r *http.Request) {
+	o.mustRender(w, r, response.ErrRender(data.MetaUnknownError.StatusCode, "Not implemented"))
+}
+
+func (o Ocs) mustRender(w http.ResponseWriter, r *http.Request, renderer render.Renderer) {
+	if err := render.Render(w, r, renderer); err != nil {
+		o.logger.Err(err).Msgf("failed to write response for ocs request %s on %s", r.Method, r.URL)
+	}
+}

services/ocs/pkg/service/v0/tracing.go

@@ -0,0 +1,28 @@
+package svc
+
+import (
+	"net/http"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/middleware"
+)
+
+// NewTracing returns a service that instruments traces.
+func NewTracing(next Service) Service {
+	return tracing{
+		next: next,
+	}
+}
+
+type tracing struct {
+	next Service
+}
+
+// ServeHTTP implements the Service interface.
+func (t tracing) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	middleware.TraceContext(t.next).ServeHTTP(w, r)
+}
+
+// GetConfig implements the Service interface.
+func (t tracing) GetConfig(w http.ResponseWriter, r *http.Request) {
+	t.next.GetConfig(w, r)
+}

services/ocs/pkg/service/v0/users.go

@@ -0,0 +1,257 @@
+package svc
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+	"net/url"
+	"strings"
+
+	storemsg "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/store/v0"
+	storesvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/store/v0"
+
+	cs3 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-micro/plugins/v4/client/grpc"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/data"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/service/v0/response"
+	ocstracing "github.com/owncloud/ocis/v2/services/ocs/pkg/tracing"
+	merrors "go-micro.dev/v4/errors"
+)
+
+// GetSelf returns the currently logged in user
+func (o Ocs) GetSelf(w http.ResponseWriter, r *http.Request) {
+	u, ok := revactx.ContextGetUser(r.Context())
+	if !ok || u.Id == nil || u.Id.OpaqueId == "" {
+		o.mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "user is missing an id"))
+		return
+	}
+	d := &data.User{
+		UserID:            u.Username,
+		DisplayName:       u.DisplayName,
+		LegacyDisplayName: u.DisplayName,
+		Email:             u.Mail,
+		UIDNumber:         u.UidNumber,
+		GIDNumber:         u.GidNumber,
+	}
+	o.mustRender(w, r, response.DataRender(d))
+	return
+}
+
+// GetUser returns the user with the given userid
+func (o Ocs) GetUser(w http.ResponseWriter, r *http.Request) {
+	userid := chi.URLParam(r, "userid")
+	userid, err := url.PathUnescape(userid)
+	if err != nil {
+		o.mustRender(w, r, response.ErrRender(data.MetaServerError.StatusCode, err.Error()))
+	}
+
+	var user *cs3.User
+	switch {
+	case userid == "":
+		o.mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "missing user in context"))
+	case o.config.AccountBackend == "cs3":
+		user, err = o.fetchAccountFromCS3Backend(r.Context(), userid)
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+
+	if err != nil {
+		merr := merrors.FromError(err)
+		if merr.Code == http.StatusNotFound {
+			o.mustRender(w, r, response.ErrRender(data.MetaNotFound.StatusCode, data.MessageUserNotFound))
+		} else {
+			o.mustRender(w, r, response.ErrRender(data.MetaServerError.StatusCode, err.Error()))
+		}
+		o.logger.Error().Err(merr).Str("userid", userid).Msg("could not get account for user")
+		return
+	}
+
+	o.logger.Debug().Interface("user", user).Msg("got user")
+
+	d := &data.User{
+		UserID:            user.Username,
+		DisplayName:       user.DisplayName,
+		LegacyDisplayName: user.DisplayName,
+		Email:             user.Mail,
+		UIDNumber:         user.UidNumber,
+		GIDNumber:         user.GidNumber,
+		Enabled:           "true", // TODO include in response only when admin?
+		// TODO query storage registry for free space? of home storage, maybe...
+		Quota: &data.Quota{
+			Free:       2840756224000,
+			Used:       5059416668,
+			Total:      2845815640668,
+			Relative:   0.18,
+			Definition: "default",
+		},
+	}
+
+	_, span := ocstracing.TraceProvider.
+		Tracer("ocs").
+		Start(r.Context(), "GetUser")
+	defer span.End()
+
+	o.mustRender(w, r, response.DataRender(d))
+}
+
+// AddUser creates a new user account
+func (o Ocs) AddUser(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// EditUser creates a new user account
+func (o Ocs) EditUser(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// DeleteUser deletes a user
+func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// EnableUser enables a user
+func (o Ocs) EnableUser(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// DisableUser disables a user
+func (o Ocs) DisableUser(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// GetSigningKey returns the signing key for the current user. It will create it on the fly if it does not exist
+// The signing key is part of the user settings and is used by the proxy to authenticate requests
+// Currently, the username is used as the OC-Credential
+func (o Ocs) GetSigningKey(w http.ResponseWriter, r *http.Request) {
+	u, ok := revactx.ContextGetUser(r.Context())
+	if !ok {
+		//o.logger.Error().Msg("missing user in context")
+		o.mustRender(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "missing user in context"))
+		return
+	}
+
+	// use the user's UUID
+	userID := u.Id.OpaqueId
+
+	c := storesvc.NewStoreService("com.owncloud.api.store", grpc.NewClient())
+	res, err := c.Read(r.Context(), &storesvc.ReadRequest{
+		Options: &storemsg.ReadOptions{
+			Database: "proxy",
+			Table:    "signing-keys",
+		},
+		Key: userID,
+	})
+	if err == nil && len(res.Records) > 0 {
+		o.mustRender(w, r, response.DataRender(&data.SigningKey{
+			User:       userID,
+			SigningKey: string(res.Records[0].Value),
+		}))
+		return
+	}
+	if err != nil {
+		e := merrors.Parse(err.Error())
+		if e.Code == http.StatusNotFound {
+			// not found is ok, so we can continue and generate the key on the fly
+		} else {
+			o.mustRender(w, r, response.ErrRender(data.MetaServerError.StatusCode, "error reading from store"))
+			return
+		}
+	}
+
+	// try creating it
+	key := make([]byte, 64)
+	_, err = rand.Read(key[:])
+	if err != nil {
+		o.mustRender(w, r, response.ErrRender(data.MetaServerError.StatusCode, "could not generate signing key"))
+		return
+	}
+	signingKey := hex.EncodeToString(key)
+
+	_, err = c.Write(r.Context(), &storesvc.WriteRequest{
+		Options: &storemsg.WriteOptions{
+			Database: "proxy",
+			Table:    "signing-keys",
+		},
+		Record: &storemsg.Record{
+			Key:   userID,
+			Value: []byte(signingKey),
+			// TODO Expiry?
+		},
+	})
+
+	if err != nil {
+		//o.logger.Error().Err(err).Msg("error writing key")
+		o.mustRender(w, r, response.ErrRender(data.MetaServerError.StatusCode, "could not persist signing key"))
+		return
+	}
+
+	o.mustRender(w, r, response.DataRender(&data.SigningKey{
+		User:       userID,
+		SigningKey: signingKey,
+	}))
+}
+
+// ListUsers lists the users
+func (o Ocs) ListUsers(w http.ResponseWriter, r *http.Request) {
+	switch o.config.AccountBackend {
+	case "cs3":
+		// TODO
+		o.cs3WriteNotSupported(w, r)
+		return
+	default:
+		o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend)
+	}
+}
+
+// escapeValue escapes all special characters in the value
+func escapeValue(value string) string {
+	return strings.ReplaceAll(value, "'", "''")
+}
+
+func (o Ocs) fetchAccountFromCS3Backend(ctx context.Context, name string) (*cs3.User, error) {
+	backend := o.getCS3Backend()
+	u, _, err := backend.GetUserByClaims(ctx, "username", name, false)
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+func (o Ocs) cs3WriteNotSupported(w http.ResponseWriter, r *http.Request) {
+	o.logger.Warn().Msg("the CS3 backend does not support adding or updating users")
+	o.NotImplementedStub(w, r)
+	return
+}

services/ocs/pkg/tracing/tracing.go

@@ -0,0 +1,23 @@
+package tracing
+
+import (
+	pkgtrace "github.com/owncloud/ocis/v2/ocis-pkg/tracing"
+	"github.com/owncloud/ocis/v2/services/ocs/pkg/config"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var (
+	// TraceProvider is the global trace provider for the ocs service.
+	TraceProvider = trace.NewNoopTracerProvider()
+)
+
+func Configure(cfg *config.Config) error {
+	var err error
+	if cfg.Tracing.Enabled {
+		if TraceProvider, err = pkgtrace.GetTraceProvider(cfg.Tracing.Endpoint, cfg.Tracing.Collector, cfg.Service.Name, cfg.Tracing.Type); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}