Add cloud id resolver interface #35732

smesterheide · 2022-12-12T05:55:05Z

Summary

This is a companion/sub PR of #34132. An application requires group ids that contain slashes and colons. Full reasoning given:

Cloud Ids consist of username and remote parts. Usernames can also be group names. Federated groups are required to have "prefixes" to distinguish them from regular groups. Here group ids (gids) are written as Uniform Resource Names (URNs) that have colons and slashes as part of the uri scheme. We need to allow these characters as part of group names. Keep in mind that groups in Nextcloud can already contain these characters anyway.

Changes

Instead of validating all possible cloud ids there is now a mechanism to register cloud id resolver

TODO

...

Checklist

Code is properly formatted
Sign-off message is added to all commits
Tests (unit, integration, api and/or acceptance) are included
Documentation (manuals or wiki) has been updated or is not required

smesterheide · 2022-12-12T05:57:58Z

The obvious question to start is why are test:[email protected] or test/[email protected] considered invalid cloud ids while groups test:foo or test/foo may exists.

come-nc · 2022-12-12T10:23:47Z

lib/private/Federation/CloudIdManager.php

+			$posSlash = strpos($id, '/');
+			$posColon = strpos($id, ':');
+
+			if ($posSlash === false && $posColon === false) {
+				$invalidPos = \strlen($id);
+			} elseif ($posSlash === false) {
+				$invalidPos = $posColon;
+			} elseif ($posColon === false) {
+				$invalidPos = $posSlash;
+			} else {
+				$invalidPos = min($posSlash, $posColon);
+			}
+
+			$lastValidAtPos = strrpos($id, '@', $invalidPos - strlen($id));


It’s not even clear to me what this code is supposed to do. The strpos dance is quite complex.

@schiessle Do you remember why these characters were forbidden?

@PVince81 @blizzz @icewind1991 Do you think allowing these characters in here can lead to trouble? They are allowed in group names so it does make sense.
In which case I would vote for removing this whole block as invalid userids should be catched elsewhere and here we should just split on the @ sign.

Puh, that's really a good question.

But whatever you do, keep in mind that you can't just split at the first @-sign. People can use email addresses as uids, so a valid federated cloud ID could look like user@mailserver@nextcloudserver. Maybe it would be safe to always split on the last @-sign but maybe I miss some other edge cases?

Yeah that’s what the strrpos is doing, finding the last @ sign.

Yes, the question for me is: why don't we just search for the last @-sign but have this offset? Do we break something when we remove the offset? My gut feeling says that it should be fine. But I hardly believe that we come up with all this logic to calculate the offset without a good reason. That's why I still fear that we miss something.

Can we find the pull request which introduced this code? Maybe the description or discussion gives us a idea why it was done this way?

I just want to give a short recount what $lastValidAtPos = strrpos($id, '@', $invalidPos - strlen($id)) does.

If there is no slash or colon, strrpos just returns the last position of at sign (or false).

Otherwise the search window for at sign is reduced by cutting off the part after the first occurrence of colon or slash (negative offset).

So user@https://example.com and [email protected]@https://example.com are both valid while urn:isbn:0451450523@https://example.com is not.

Maybe the reason for having this complex logic was to support URLs with userinfo like user@https://username:[email protected]. This would correctly identify the first at sign as lastValidAtPos while a simple strrpos($cloudId, '@') does not.

Can we find the pull request which introduced this code? Maybe the description or discussion gives us a idea why it was done this way?

This one might be relevant to the discussion: 2b7e5f8

Instead of validating all possible cloud ids there is now a mechanism to register cloud id resolvers.

Validation has become more user-centric in 256fbe9.

come-nc · 2022-12-12T10:33:22Z

Does anyone know if there is a documented limit of size for federated cloud id?
Where is the specification for that format anyway?

PVince81 · 2022-12-12T10:43:41Z

@come-nc there is likely a limit, either 512 or 255 chars, potentially shorter, see oc_share_external column "remote" and "remote_id"

smesterheide · 2023-02-20T03:49:48Z

oc_share_external.user does have a limitation of 64 characters. There is a migration in #34132 to increase it to 255 characters in order to support long group names.

smesterheide · 2023-02-20T04:35:11Z

lib/public/Federation/ICloudIdResolver.php

+	/**
+	 * Check if the input is a correctly formatted cloud id
+	 *
+	 * @param string $cloudId
+	 * @return bool
+	 *
+	 * @since 26.0.0
+	 */
+	public function isValidCloudId(string $cloudId): bool;


If the resolver returns true it indicates to the CloudIdManager that this cloud id should also be resolved by it. This is a cursory check and an exception can still be thrown during resolveCloudId

Signed-off-by: Sandro Mesterheide <[email protected]>

come-nc · 2023-03-27T08:56:22Z

lib/public/Federation/ICloudIdManager.php

+	 *
+	 * @since 26.0.0
+	 */
+	public function registerCloudIdResolver(ICloudIdResolver $resolver);


Suggested change

public function registerCloudIdResolver(ICloudIdResolver $resolver);

public function registerCloudIdResolver(ICloudIdResolver $resolver): void;

come-nc · 2023-03-27T08:56:36Z

lib/public/Federation/ICloudIdManager.php

+	 *
+	 * @since 26.0.0
+	 */
+	public function unregisterCloudIdResolver(ICloudIdResolver $resolver);


Suggested change

public function unregisterCloudIdResolver(ICloudIdResolver $resolver);

public function unregisterCloudIdResolver(ICloudIdResolver $resolver): void;

come-nc · 2023-03-27T08:58:09Z

lib/public/Federation/CloudId.php

-namespace OC\Federation;
-
-use OCP\Federation\ICloudId;
+namespace OCP\Federation;

 class CloudId implements ICloudId {


Suggested change

class CloudId implements ICloudId {

/**

* @since 27.0.0

*/

class CloudId implements ICloudId {

https://github.com/nextcloud/server/actions/runs/4225564685/jobs/7338004053?pr=35732

come-nc · 2023-03-27T08:58:21Z

lib/public/Federation/ICloudIdManager.php

+	/**
+	 * @param ICloudIdResolver $resolver
+	 *
+	 * @since 26.0.0


Suggested change

* @since 26.0.0

* @since 27.0.0

come-nc · 2023-03-27T08:58:31Z

lib/public/Federation/ICloudIdManager.php

+	/**
+	 * @param ICloudIdResolver $resolver
+	 *
+	 * @since 26.0.0


Suggested change

* @since 26.0.0

* @since 27.0.0

come-nc · 2023-03-27T08:58:48Z

lib/private/Federation/CloudIdManager.php

+	/**
+	 * @param ICloudIdResolver $resolver
+	 */
+	public function unregisterCloudIdResolver(ICloudIdResolver $resolver) {


Suggested change

public function unregisterCloudIdResolver(ICloudIdResolver $resolver) {

public function unregisterCloudIdResolver(ICloudIdResolver $resolver): void {

come-nc · 2023-03-27T08:58:55Z

lib/private/Federation/CloudIdManager.php

+	/**
+	 * @param ICloudIdResolver $resolver
+	 */
+	public function registerCloudIdResolver(ICloudIdResolver $resolver) {


Suggested change

public function registerCloudIdResolver(ICloudIdResolver $resolver) {

public function registerCloudIdResolver(ICloudIdResolver $resolver): void {

come-nc · 2023-03-27T09:00:00Z

lib/private/Federation/CloudIdManager.php

@@ -100,6 +104,12 @@ public function handleCardEvent(Event $event): void {
 	 */
 	public function resolveCloudId(string $cloudId): ICloudId {
 		// TODO magic here to get the url and user instead of just splitting on @
+
+		foreach ($this->cloudIdResolvers as $resolver) {


Not sure if there is a better way, but isValidCloudId will be called twice on each resolver, since it is then called by $this->isValidCloudId. Not ideal performance-wise long-term.

sorbaugh · 2024-08-16T09:21:14Z

Hello @smesterheide , looks like this PR was marked as "stale". But would like to reach out since there was already quite some work put here and would encourage you to ping me here to see if you'd like to reopen! 🚀

smesterheide requested a review from come-nc December 12, 2022 05:58

come-nc reviewed Dec 12, 2022

View reviewed changes

szaimen added this to the Nextcloud 26 milestone Dec 12, 2022

szaimen added the 3. to review Waiting for reviews label Dec 12, 2022

szaimen requested review from a team, PVince81 and icewind1991 and removed request for a team December 12, 2022 11:58

PVince81 requested a review from ArtificialOwl January 10, 2023 09:43

blizzz mentioned this pull request Feb 1, 2023

26.0.0 beta 2 #36484

Merged

smesterheide force-pushed the enh/extend-allowed-cloud-id-characters branch from a283542 to 2fe2427 Compare February 20, 2023 03:19

smesterheide mentioned this pull request Feb 20, 2023

Add new share type for federated groups #34132

Closed

3 tasks

smesterheide changed the title ~~Allow slash and colon characters in cloud id~~ Add cloud id resolver interface Feb 20, 2023

smesterheide commented Feb 20, 2023

View reviewed changes

Add cloud id resolver interface

6deb049

Signed-off-by: Sandro Mesterheide <[email protected]>

smesterheide force-pushed the enh/extend-allowed-cloud-id-characters branch from 2fe2427 to 6deb049 Compare February 20, 2023 16:56

skjnldsv mentioned this pull request Feb 23, 2023

26.0.0 beta 5 #36834

Merged

blizzz mentioned this pull request Mar 7, 2023

26.0.0 RC2 #37078

Merged

blizzz modified the milestones: Nextcloud 26, Nextcloud 27 Mar 9, 2023

come-nc reviewed Mar 27, 2023

View reviewed changes

This was referenced May 3, 2023

27.0.0 beta 1 #38038

Merged

27.0.0 beta 2 #38137

Closed

27.0.0 beta 2 #38139

Merged

blizzz mentioned this pull request May 17, 2023

27.0.0 RC1 #38341

Merged

blizzz removed this from the Nextcloud 27 milestone May 23, 2023

blizzz added this to the Nextcloud 28 milestone May 23, 2023

skjnldsv mentioned this pull request Nov 1, 2023

chore: 28.0.0 beta 1 #41228

Merged

This was referenced Nov 6, 2023

28.0.0 beta 2 #41314

Merged

28.0.0 beta 3 #41379

Merged

This was referenced Nov 14, 2023

28.0.0 beta 4 #41477

Merged

28.0.0 RC1 #41621

Merged

blizzz modified the milestones: Nextcloud 28, Nextcloud 29 Nov 23, 2023

This was referenced Mar 12, 2024

29.0.0 beta 2 #44152

Merged

29.0.0 beta 3 #44186

Merged

29.0.0 beta 4 #44275

Merged

This was referenced Mar 20, 2024

29.0.0 beta 5 #44361

Merged

29.0.0 beta 6 #44449

Merged

skjnldsv mentioned this pull request Mar 28, 2024

29.0.0 RC1 #44552

Merged

81 tasks

skjnldsv modified the milestones: Nextcloud 29, Nextcloud 30 Mar 28, 2024

skjnldsv added 2. developing Work in progress stale Ticket or PR with no recent activity and removed 3. to review Waiting for reviews labels Jul 27, 2024

This was referenced Jul 30, 2024

30.0.0 beta 2 #46870

Merged

30.0.0 beta 3 #46946

Merged

This was referenced Aug 5, 2024

30.0.0 beta 4 #47028

Merged

30.0.0 beta 5 #47100

Merged

skjnldsv mentioned this pull request Aug 13, 2024

30.0.0 RC1 #47190

Merged

skjnldsv closed this Aug 14, 2024

skjnldsv removed this from the Nextcloud 30 milestone Aug 14, 2024

skjnldsv deleted the enh/extend-allowed-cloud-id-characters branch August 16, 2024 09:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cloud id resolver interface #35732

Add cloud id resolver interface #35732

smesterheide commented Dec 12, 2022 •

edited

Loading

smesterheide commented Dec 12, 2022

come-nc Dec 12, 2022

schiessle Dec 12, 2022 •

edited

Loading

come-nc Dec 13, 2022

schiessle Dec 13, 2022

smesterheide Dec 13, 2022

smesterheide Dec 16, 2022

smesterheide Feb 20, 2023 •

edited

Loading

come-nc commented Dec 12, 2022

PVince81 commented Dec 12, 2022

smesterheide commented Feb 20, 2023

smesterheide Feb 20, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

come-nc Mar 27, 2023

sorbaugh commented Aug 16, 2024

	public function registerCloudIdResolver(ICloudIdResolver $resolver);
	public function registerCloudIdResolver(ICloudIdResolver $resolver): void;

	public function unregisterCloudIdResolver(ICloudIdResolver $resolver);
	public function unregisterCloudIdResolver(ICloudIdResolver $resolver): void;

Add cloud id resolver interface #35732

Add cloud id resolver interface #35732

Conversation

smesterheide commented Dec 12, 2022 • edited Loading

Summary

Changes

TODO

Checklist

smesterheide commented Dec 12, 2022

Choose a reason for hiding this comment

schiessle Dec 12, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

smesterheide Feb 20, 2023 • edited Loading

Choose a reason for hiding this comment

come-nc commented Dec 12, 2022

PVince81 commented Dec 12, 2022

smesterheide commented Feb 20, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sorbaugh commented Aug 16, 2024

smesterheide commented Dec 12, 2022 •

edited

Loading

schiessle Dec 12, 2022 •

edited

Loading

smesterheide Feb 20, 2023 •

edited

Loading