cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,569 Commits 2 Branches 0 Tags
b69c18b9342edfccb10a67a5b6af31219344c6a4
Commit Graph

1569 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dionisio Pozo b69c18b934 Merge pull request #598 from EdouardVanbelle/feat/readonly-drive 2026-07-16 07:40:29 +02:00
Dionisio Pozo c9b2daec75 Merge pull request #597 from EdouardVanbelle/fix/595-quota-issue 2026-07-16 07:40:16 +02:00
Edouard Vanbelle a6427fc028 feat(drive): add readonly policy 
permmit admin to freeze a drive, trash janitor background job is also disabled for this drive
 2026-07-16 01:02:15 +02:00
Edouard Vanbelle 53c301e472 fix(595): permit unlimited user quota 2026-07-15 22:21:51 +02:00
Dionisio Pozo 346e2e879c Merge pull request #594 from EdouardVanbelle/feat/caldav-read-side 
fix(caldav) read side + enable caldav/cardav CI test suite
 2026-07-15 09:46:11 +02:00
Edouard Vanbelle 7de83de0a9 chore(ci): wire caldav/carddav test suite 2026-07-15 07:55:31 +02:00
Edouard Vanbelle cb6c29a063 fix(caldav): fix generation of events 
keep information of: ATTENDEE, ORGANIZER, CATEGORIES, STATUS, TRANSP, VALARM, X-*

    this fix answer in all calldav GET
 2026-07-15 07:55:31 +02:00
Edouard Vanbelle e360d093bb test(caldav+carddav): rm xfail mark on known cases 2026-07-15 07:55:31 +02:00
Dionisio Pozo e0b9e23201 Merge pull request #591 from EdouardVanbelle/fix/caldav-time-range-parser 
fix(ical): fix timerange issue
 2026-07-15 07:22:14 +02:00
Dionisio Pozo fc5a3a581f Merge pull request #592 from EdouardVanbelle/fix/carddav-parser-tel-adr 
fix(carddav): fix tel uri
 2026-07-15 07:21:57 +02:00
Edouard Vanbelle 99d0287fec fix(test): NextcloudChunkedUploadService 
fix timing issues during tests that raises:

```
thread 'infrastructure::services::nextcloud_chunked_upload_service::tests::test_chunk_paths_sorted_regardless_of_upload_order' (6962) panicked at src/infrastructure/services/nextcloud_chunked_upload_service.rs:306:9:
assertion `left == right` failed
  left: [66, 67]
 right: [65, 66, 67]
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
```
 2026-07-14 23:38:22 +02:00
Edouard Vanbelle a67fcadeea fix(ical): fix timerange issue 
accept iCal DATE-TIME + RFC 3339 fallback
 2026-07-14 23:13:50 +02:00
Dionisio Pozo bad3abba27 Merge pull request #590 from EdouardVanbelle/test/caldav 2026-07-14 23:12:27 +02:00
Dionisio Pozo 4336cf97b4 Merge pull request #589 from EdouardVanbelle/fix/caldav-carddav-error-mapping 2026-07-14 23:12:11 +02:00
Dionisio Pozo a15987b1f0 Merge pull request #588 from EdouardVanbelle/fix/528-Recurrence-on-ical 2026-07-14 23:10:19 +02:00
Edouard Vanbelle dc2c8f5dcd fix(carddav): fix tel uri 2026-07-14 23:00:19 +02:00
Edouard Vanbelle ad85fd5b91 fix(caldav+carddav): return correct error rather 500 2026-07-14 22:27:30 +02:00
Edouard Vanbelle a9e05ec47c test: full caldav + carddav test suite 2026-07-14 22:01:31 +02:00
Edouard Vanbelle 7966c7178a fix(528): pass3: PUT with RECURRENCE-ID 2026-07-14 20:42:18 +02:00
Edouard Vanbelle 02f67f7a5c fix(528): pass2 add recurrence_id field 2026-07-14 20:42:18 +02:00
Edouard Vanbelle 184b9dfab6 fix(528): ical and recurrence 
import use if ical and use ical::IcalParser
    prepare unit test
 2026-07-14 20:42:18 +02:00
Dionisio Pozo 7557084ad3 Merge pull request #586 from EdouardVanbelle/fix/caldav+carddav-error-handling 
fix(caldav+carddav) error handling
 2026-07-14 15:59:34 +02:00
Edouard Vanbelle a7a45b3383 fix(caldav+carddav): raise 400 error on param issue 
rather than a 500
 2026-07-14 14:52:58 +02:00
Dionisio Pozo 4b98f8f0e7 Merge pull request #584 from EdouardVanbelle/doc/update 
doc: update doc to reflect recent changes
 2026-07-14 14:30:49 +02:00
Edouard Vanbelle 54b5b3bf4f feat(caldav+carddav): auto create default cal & card 
automatically create default Calendar and default addressbook per user
    (no creation if user already have a such resource)

    default name are "Personal"

    this is using the user's life cycle like does the drives

    answers to issue #545
 2026-07-14 14:30:05 +02:00
Edouard Vanbelle 5e95d6dccf doc: update doc to reflect recent changes 
- grants: permission moved to roles
    - new resources (Drive, Caldav, Carddav, Playlist) now using ReBAC
    - expired shared now cleaned up
    - drive visible in Webdav
    - new login/registration options (domain allow list, policies, etc)
    - upgrade of external user into internal user
 2026-07-14 13:31:48 +02:00
Dionisio Pozo 970f97b91a Merge pull request #570 from swissiety/rfc-4331-quota-properties 
feat(webdav): RFC 4331 quota-available-bytes/quota-used-bytes
 2026-07-14 12:58:22 +02:00
Dionisio Pozo 3ecfddd6b8 Merge pull request #583 from EdouardVanbelle/doc/app-password 
doc(app password): correct doc: webdav login via app password
 2026-07-14 12:58:06 +02:00
Dionisio Pozo 0832f48791 Merge pull request #582 from EdouardVanbelle/security 
security(auth): specify to agents that OIDC should never be bypassed
 2026-07-14 12:23:33 +02:00
Edouard Vanbelle ebb11f19c2 doc(webdav): login is via app password 2026-07-14 12:21:51 +02:00
Dionisio Pozo 2f1bea165c Merge pull request #581 from EdouardVanbelle/vitepress 
chore(vitepress): convert ../ references to DioCrafts/OxiCloud links
 2026-07-14 12:16:32 +02:00
Dionisio Pozo bfc7a79423 Merge pull request #580 from EdouardVanbelle/feat/user-upgrade 
feat(user upgrade): permit upgrade of in invited account into internal account
 2026-07-14 12:11:11 +02:00
Edouard Vanbelle f738e3f442 security(auth): specify to agents that OIDC should never be bypassed 2026-07-14 12:07:30 +02:00
Edouard Vanbelle 33d0c460fd chore(vitepress): convert ../ references to github/DioCrafts/OxiCloud links 
unblock site generation and link code reference to github DioCrafts/OxiCloud project
 2026-07-14 12:02:12 +02:00
Edouard Vanbelle 1fa1966fbe feat(upgrate): add i18n for account upgade 2026-07-14 11:40:16 +02:00
Edouard Vanbelle f331dbf0ee feat(account): upgrade external to internal 2026-07-14 11:10:23 +02:00
Dionisio Pozo 5ae551a93d Merge pull request #577 from EdouardVanbelle/feat/users-perfs-and-filter-dotfiles 
feat: users prefs server side + filter dotfiles + filter shares by resource type
 2026-07-14 09:07:09 +02:00
Dionisio Pozo 17bfb57af7 Merge pull request #578 from EdouardVanbelle/feat/user-regisration-with-allow-list 
feat(registration): add a domain allow list
 2026-07-14 09:06:34 +02:00
Edouard Vanbelle 341e354162 test(frontend): correct test to fit sign up/in 2026-07-14 03:27:28 +02:00
Edouard Vanbelle 691d01a458 clippy 2026-07-14 03:18:04 +02:00
Edouard Vanbelle 3350e77080 fix(env): ensure .env is not taken when using --config 2026-07-14 03:16:27 +02:00
Edouard Vanbelle 0ad283e590 fix(magic-link): correct url to fit sveltekit 2026-07-14 03:16:27 +02:00
Edouard Vanbelle e94063d96a test(login/register): via password or magic-link 
Password login

┌─────┬────────────────────────────────────────────────────┬────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────┐
│  #  │                        Case                        │         Where          │                                          Assertion                                          │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L1  │ Login by username                                  │ auth_login.hurl Case 1 │ 200 + access_token, user.email match                                                        │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L2  │ Login by email (dispatch on @)                     │ auth_login.hurl Case 2 │ 200, same session shape as L1                                                               │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L3  │ Bad password on username path                      │ auth_login.hurl Case 3 │ 403 anti-enum                                                                               │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L4  │ Bad password on email path                         │ auth_login.hurl Case 4 │ 403 anti-enum (same shape as L3)                                                            │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L5  │ Unknown username                                   │ auth_login.hurl Case 5 │ 403 anti-enum (same shape as L3)                                                            │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L6  │ Unknown email                                      │ auth_login.hurl Case 6 │ 403 anti-enum (same shape as L3)                                                            │
├─────┼────────────────────────────────────────────────────┼────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤
│ L7  │ /api/auth/oidc/providers reports methods correctly │ auth_login.hurl Case 7 │ password_login_enabled: true, magic_link_login_enabled: true, require_verified_email: false │
└─────┴────────────────────────────────────────────────────┴────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────┘

Password registration

┌─────┬───────────────────────────────────────────────────┬──────────────────────────────┬─────────────────────────────────────────────────────────┐
│  #  │                       Case                        │            Where             │                        Assertion                        │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R1  │ Classic username + email + password → uniform 200 │ registration.hurl Step 2     │ anti-enum message contains "request received"           │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R2  │ Login after register works                        │ registration.hurl Step 2b    │ 200 + session for the new user                          │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼─────────────────────────────────────────────────────────┤
│ R3  │ Email collision → uniform 200 (no rewrite)        │ registration.hurl Steps 8-10 │ attacker password doesn't work; original account intact │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R4  │ Username collision → uniform 200                  │ registration.hurl Step 11    │ same anti-enum shape                                    │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R5  │ Off-domain rejection                              │ registration.hurl Step 12    │ 403 RegistrationDomainNotAllowed                        │
├─────┼───────────────────────────────────────────────────┼──────────────────────────────┼────────────────────────────┤
│ R6  │ Case-insensitive domain match                     │ registration.hurl Step 12b   │ uniform 200 on charlie@EXAMPLE.COM                      │
└─────┴───────────────────────────────────────────────────┴──────────────────────────────┴────────────────────────────┘

Magic-link registration (email-only signup)

┌─────┬──────────────────────────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────┐
│  #  │                                               Case                                               │             Where             │                   Assertion                    │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR1 │ Email-only signup → welcome mail queued                                                          │ registration.hurl Step 3      │ uniform 200 + browser-binding cookie set       │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR2 │ Welcome mail contains magic-link URL                                                             │ registration.hurl Step 4      │ captured from mock SMTP                        │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR3 │ PR 22 cross-browser confirmation page                                                            │ registration.hurl Step 5a     │ 200 HTML "different browser"                   │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR4 │ Cookie-bound redemption lands on SPA                                                             │ registration.hurl Step 5b     │ 302 → /files (SvelteKit route, post-migration) │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR5 │ email_verified_at stamped after redemption                                                       │ registration.hurl Step 6      │ field present on /api/auth/me                  │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR6 │ Second magic-link post-signup                                                                    │ registration.hurl Step 7      │ uniform 200                                    │
├─────┼──────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ MR7 │ Profile PATCH — no-op, name set, empty-string rejected, username-taken 409, claim-once 409, etc. │ registration.hurl Steps 6a–6i │ full profile lifecycle                         │
└─────┴──────────────────────────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────┘

Magic-link login (existing account)

┌─────┬──────────────────────────────────────────────────────────┬──────────────────────────────────────┬───────────────────────────────────────┐
│  #  │                           Case                           │                Where                 │                             Assertion                              │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML1 │ Baseline password login still works                      │ auth_magic_link_login.hurl Steps 1-2 │ 200                                                                │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML2 │ magic-link/send with email identifier                    │ auth_magic_link_login.hurl Step 3    │ uniform 200 + cookie                                               │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML3 │ magic-link/send with username identifier (dispatch on @) │ auth_magic_link_login.hurl Step 4    │ uniform 200                                                        │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML4 │ Password-user policy: mail actually sent                 │ auth_magic_link_login.hurl Step 5    │ SMTP capture proves permit_magic_link_for_password_users in effect │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML5 │ Redemption creates a session                             │ auth_magic_link_login.hurl Steps 6-7 │ 302 → /files, /api/auth/me returns the same user                   │
├─────┼──────────────────────────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────┤
│ ML6 │ Anti-enum on unknown identifier                          │ auth_magic_link_login.hurl Step 8    │ same uniform 200 shape as ML3                                      │
└─────┴──────────────────────────────────────────────────────────┴──────────────────────────────────────┴───────────────────────────────────────┘

OIDC

┌─────┬────────────────────────────────────────────────────────────────────────┬───────────────────┬────────────────────────────────────────────────────────────────────────────────────────────┐
│  #  │                                  Case                                  │       Where       │                                                        Assertion                                                        │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O1  │ Setup local admin (bootstrap)                                          │ oidc.hurl Step 1  │ 201                                                                                                                     │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O2  │ Providers endpoint — OIDC visible                                      │ oidc.hurl Step 2  │ enabled: true, provider_name: MockSSO, password_login_enabled: true, magic_link_login_enabled: false (OIDC-master rule) │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O2b │ Magic-link/send refused (endpoint layer)                               │ oidc.hurl Step 2b │ 403 MagicLinkLoginDisabled — proves the policy gate fires, not a 503 SMTP-unwired                                       │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O3  │ Authorize redirect includes PKCE + state                               │ oidc.hurl Step 3  │ 307 to fake IdP                                                                                                         │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O4  │ IdP round-trip + JIT provisioning                                      │ oidc.hurl Step 4  │ Callback lands on /login?oidc_code=…                                                                                    │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O5  │ Code exchange → session cookies                                        │ oidc.hurl Step 5  │ 200 + all three cookies                                                                                                 │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O6  │ JIT profile mapping (name, given/family, picture, groups → admin role) │ oidc.hurl Step 6  │ every claim reflected on /api/auth/me                                                                                   │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O7  │ Refresh rotation on OIDC session                                       │ oidc.hurl Step 7  │ new access/refresh/CSRF cookies                                                                                         │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O8  │ Refreshed cookies authenticate                                         │ oidc.hurl Step 8  │ 200 on /api/auth/me                                                                                                     │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O9  │ Repeat login = same local user (no dup)                                │ oidc.hurl Step 9  │ user_id stable                                                                                                          │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O10 │ Anti-takeover: unverified email → refused                              │ oidc.hurl Step 10 │ 401/403                                                                                                                 │
├─────┼────────────────────────────────────────────────────────────────────────┼───────────────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ O11 │ One-time code replay refused                                           │ oidc.hurl Step 11 │ second /exchange → 401                                                                                                  │
└─────┴────────────────────────────────────────────────────────────────────────┴───────────────────┴────────────────────────────────────────────────────────────────────────────────────────────┘

test
 2026-07-14 03:16:25 +02:00
Edouard Vanbelle 01da450cf6 feat(registration): add a domain allow list 
add:
 - OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS to specify list of domains allowing a self registration
 - OXICLOUD_REQUIRE_VERIFIED_EMAIL=true|false
 - OXICLOUD_AUTH_METHODS=password,magic_link (login methods, OIDC is on top of this)
 - OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users (OIDC is on top)
 2026-07-14 02:43:39 +02:00
Edouard Vanbelle 3fe6af25f1 fix(loading): fix issue with sveltekit and scripts 
fix issues like:
```
Executing inline script violates the following Content Security Policy directive 'script-src 'self''.
Either the 'unsafe-inline' keyword, a hash ('sha256-Vv9My0PApDW3C+xGLu9cH98KLrOg/Qhc7hlT1lK5tyM='),
or a nonce ('nonce-...') is required to enable inline execution. The action has been blocked.
```
 2026-07-14 02:26:36 +02:00
Edouard Vanbelle b9d6fa39c0 feat(user-pref): revert view mode as user-prefs serverside 
previous change is breaking playwright tests, need to check later changes
 2026-07-13 23:16:09 +02:00
M.Schmidt c62f97d8f2 readd removed utility, cleanup/shorten enum usage 2026-07-13 22:22:12 +02:00
Edouard Vanbelle b18f0dc74a test(front): isolate dotfile e2e fixtures under scratch parents 2026-07-13 22:00:53 +02:00
Dionisio Pozo 899a08bebe Merge pull request #575 from EdouardVanbelle/doc/drive 
docs(drive): add drive doc
 2026-07-13 21:36:22 +02:00
Dionisio Pozo 2d49c3c8de Merge pull request #574 from EdouardVanbelle/fix/nextcloud-with-oidc-and-drive-picker 
fix(nc): login OIDC + drive picker
 2026-07-13 21:36:08 +02:00